Overview

overview

10

Static

static

3

818602018d...a7.exe

windows10-2004-x64

10

818602018d...a7.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    4s
  • max time network
    62s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 09:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7.exe
  • Size 5.4MB
  • Sample260828-lcfevscd72
  • SHA256 818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    anonymous
  • Password

    [email protected]

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 11 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • Views/modifies file attributes 1 TTPs 12 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7.exe
    "C:\Users\Admin\AppData\Local\Temp\818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\AppData\Local\Temp\818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7.exe
      "C:\Users\Admin\AppData\Local\Temp\818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5684
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe"
          4⤵
          • Views/modifies file attributes
          PID:2912
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4176
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x390,0x7ffec00dc188,0x7ffec00dc194,0x7ffec00dc1a0
          4⤵
            PID:3308
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,17980387150143674635,17345053353174011778,524288 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:11
            4⤵
            • System Time Discovery
            PID:4664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,17098954646631771406,6024567803027182386,262144 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
            4⤵
              PID:5136
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,16581451384500049844,16758474837718914218,524288 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
              4⤵
                PID:4040
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,15107909371958033371,9465937779257449722,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
                4⤵
                  PID:6120
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,10801234839184538466,6423169943670158932,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
                  4⤵
                    PID:4560
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,10714905497364487207,9189244562057978006,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                    4⤵
                      PID:808
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4924,i,11037780858545079837,6781462096837049788,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
                      4⤵
                        PID:5808
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5356,i,8253843822861413704,13250401564970603343,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
                        4⤵
                          PID:4964
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5532,i,846613704092789041,15450433983727119277,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
                          4⤵
                            PID:4580
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5616,i,14920470120246057186,4703319868022766033,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
                            4⤵
                              PID:5312
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5860,i,14356429709200537809,2617289249550165872,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
                              4⤵
                                PID:3568
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6100,i,13823226033032191505,7441397860528975063,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
                                4⤵
                                  PID:1412
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4364,i,7683540466428263813,33780463488344985,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
                                  4⤵
                                    PID:832
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6164,i,4620216392014754249,8280497298283719292,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
                                    4⤵
                                      PID:4156
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6216,i,7604889281003564006,12227327196236261105,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
                                      4⤵
                                        PID:2912
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6696,i,6040789860062411246,11662347586168928720,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
                                        4⤵
                                          PID:2456
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6748,i,10085167182341633015,13218318562356101445,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
                                          4⤵
                                            PID:5452
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6932,i,1393361835762761773,15827584049331664713,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
                                            4⤵
                                              PID:2916
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7232,i,6621401283047372742,14421693354634354023,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
                                              4⤵
                                                PID:5556
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7084,i,3471269392697785111,14625707845654943630,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
                                                4⤵
                                                  PID:2976
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6000,i,17532379887090530580,4543612545875156258,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:1
                                                  4⤵
                                                    PID:2128
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,17247506576503960869,4686562591074588895,524288 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12
                                                    4⤵
                                                      PID:6584
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7748,i,15760961577090615802,12251019374575958736,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
                                                      4⤵
                                                        PID:6660
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7744,i,9076399120959421958,6356551412441356330,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
                                                        4⤵
                                                          PID:6640
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7712,i,18372065258797724280,15715266430626850140,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
                                                          4⤵
                                                            PID:6652
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7764,i,13410987476875623601,5101276386174145750,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
                                                            4⤵
                                                              PID:6632
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7792,i,3789182907571066163,11998063893556221,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
                                                              4⤵
                                                                PID:4656
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7868,i,9727466226292722955,5548650083729316701,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:1
                                                                4⤵
                                                                  PID:6824
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6108,i,14930735156266007861,2344521899611730596,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
                                                                  4⤵
                                                                    PID:3188
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7836,i,17648487026984990476,16158371547318503798,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:1
                                                                    4⤵
                                                                      PID:6812
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7900,i,12385129969238529567,18139024898988044414,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
                                                                      4⤵
                                                                        PID:3048
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7972,i,11697573482549366777,4768874119073557968,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9236 /prefetch:1
                                                                        4⤵
                                                                          PID:6052
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7984,i,3856049232138650361,12555463678561821688,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
                                                                          4⤵
                                                                            PID:4244
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7852,i,9115775012689235816,7766074046265797253,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
                                                                            4⤵
                                                                              PID:3316
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8012,i,7149721850987831011,8028201926791826186,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9244 /prefetch:1
                                                                              4⤵
                                                                                PID:1924
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6156,i,2353301572179738807,10329986820861253845,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:1
                                                                                4⤵
                                                                                  PID:5808
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8040,i,16321735794566313394,5455888447730310585,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9256 /prefetch:1
                                                                                  4⤵
                                                                                    PID:6808
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8092,i,10574009653572835065,13502658086590734778,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
                                                                                    4⤵
                                                                                      PID:6784
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6572,i,18310955371221814223,16072666690566205293,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
                                                                                      4⤵
                                                                                        PID:4708
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6556,i,908783127443100868,12849456638164259820,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:1
                                                                                        4⤵
                                                                                          PID:5588
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6564,i,10391667133366382908,1808785000236934757,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
                                                                                          4⤵
                                                                                            PID:6804
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8132,i,10706589491873977177,4916995610955813647,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
                                                                                            4⤵
                                                                                              PID:4624
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6500,i,12940296526705684306,3418445755785408470,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:1
                                                                                              4⤵
                                                                                                PID:7028
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6536,i,10330265174527847799,3001630112510740976,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:7044
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5708,i,9357891027545598369,1843615681513835121,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:6872
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3796,i,3072620136461810324,8887947834748771049,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:4844
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=3804,i,10974939416083203240,1379377451903754027,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:1732
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8224,i,337168880161468725,15005316954443961042,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:2680
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6524,i,5926556112608363885,923191667956266319,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:1560
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=3780,i,7693634529012417649,8438887036638227030,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:796
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=6192,i,7464446471949461815,4472754997987237278,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9696 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:2096
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4376,i,13838893408717425727,1214265716975182107,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:2640
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6272,i,10784396255045707577,12699335273920086211,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9756 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:1652
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6348,i,5885788208882216048,1386280967579901242,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:4688
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=3928,i,15767367185911442124,3387689777272054413,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:3328
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5420,i,4927355660355751389,15555723533091610392,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:3432
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8168,i,6188253721708750708,15212947261403259911,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:2156
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8240,i,8595286407110894265,16371360937044381821,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:2428
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6304,i,14162863228636060615,12617332211871884094,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:7092
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=6244,i,6541619766774988994,14400062018214096053,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9660 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:2960
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=6292,i,9967706471565949356,14068556985358274885,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9760 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:1112
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=6240,i,8594421447611116983,1110619936414174612,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:7064
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8296,i,7592458715937315148,18334717572747980056,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9840 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:7096
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5440,i,1499603868244852690,5168186410475547834,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9940 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:3492
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8288,i,2361841541813284181,4409118768410668702,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9820 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:7060
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8320,i,6799178348660023978,2235134302242484997,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9860 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:6120
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8796,i,15251627944735099104,12662178866708800551,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9996 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:2380
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8820,i,1740124910782302537,16237937619865066362,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10112 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:7112
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8776,i,1357958780172676738,5950500383650719647,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9976 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6232
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8332,i,1870309663775330554,18146484822971739643,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6236
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8348,i,456141657948909502,13442513541123522827,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:6152
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=5080,i,11065661137036681946,17908686059288576874,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10152 /prefetch:1
                                                                                                                                                        4⤵
                                                                                                                                                          PID:6252
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=4836,i,16007124884458635357,1176722259602976816,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
                                                                                                                                                          4⤵
                                                                                                                                                            PID:7152
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=4800,i,17799110086934250256,13884426123933233422,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:1
                                                                                                                                                            4⤵
                                                                                                                                                              PID:6148
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4860,i,829735736656581283,13414010461620174375,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10088 /prefetch:1
                                                                                                                                                              4⤵
                                                                                                                                                                PID:7140
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8404,i,9511397882334139488,15792381059894701061,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:1
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2776
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=4852,i,279423424016411724,14673230629173031663,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10020 /prefetch:1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1364
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8840,i,18378101889968377040,16718753124823961660,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=10132 /prefetch:1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:5544
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=13464,i,5132516181406460012,11042956593309974739,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=15004 /prefetch:1
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:8436
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=8296,i,8916109048095195065,17300504352199923073,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=16456 /prefetch:1
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:8592
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=16740,i,13056519470687300894,6579386018975139289,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=16336 /prefetch:1
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:8716
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=11340,i,9622616067267495981,18400130974831355297,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:8828
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=16924,i,5943039567248836410,2998976272618631713,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=11384 /prefetch:1
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:8920
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=16964,i,10774920834119105457,345469147890847202,2097152 --field-trial-handle=2392,i,17120752337867817720,17217931522145364471,262144 --variations-seed-version --mojo-platform-channel-handle=16304 /prefetch:1
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:8932
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1348
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5832
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4812
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5576
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4016
                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:2624
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3364
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                              PID:5232
                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                PID:4364
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5432
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3372
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3384
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xheg7fn\m0yxyyr3.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:792
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                            PID:5560
                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                              PID:5568
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5836
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5424
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5496
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5424
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6188
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:476
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdzahzwa\j7bb27qu.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6260
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                          PID:6300
                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:6360
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:6412
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6436
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6516
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6564
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6616
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6764
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rheovwx2\6gt3mcwb.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6944
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                        PID:6984
                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                          PID:7040
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:7092
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:7112
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:5496
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:6204
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:6224
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:6552
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pcuojlwy\0el7la2s.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6564
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                        PID:6820
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:6876
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:7048
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:7060
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:7132
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:6164
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ibemvhsq\x0zdfxnj.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:6208
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                    PID:6360
                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                      PID:6392
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:6632
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:6824
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:3844
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6h4orht\xzunmn8r.exe
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                  PID:676
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:7140
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:6180
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:6256
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:6424
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:6384
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:6592
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cxkuzdkf\ux2j17ne.exe
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:6680
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                PID:6816
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:2156
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:7144
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5496
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:6320
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jra2gkl8\x6znpr1b.exe
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:3516
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                              PID:3924
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                PID:4468
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:8412
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:8568
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:8692
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:8812
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:9096
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jih5b2wu\qw13fl0i.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:6184
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                            PID:8232
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                              PID:8456
                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:9204
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:256
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:2504
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:8848
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8dbu9n90\j5q7qax9.exe
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:8236
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cekkdia9\kw4jbau8.exe"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                          PID:9624
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cekkdia9\kw4jbau8.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                            PID:10012

                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                                                                                                                          • SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                                                                                                                          • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_00006c
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                                                                                                                                                                                                                                                                                          • Size 298KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 696199a15eff53a63e762d0ee7eba1c00d4503d7110e7ae8b709d95532a7430a
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_00006d
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
                                                                                                                                                                                                                                                                                                                                          • Size 293KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 08cb095bb2f1a6712071f44a676cae1b9f47965d922488bcf15c9dce52494b13
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_00006e
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                                                                                                                                                                                                                                                          • Size 75KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 3b4b2fc56d46b5c95f4d2a790b21221bf4d3cc3e6c14ce66a2e2c249da27ff26
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_00006f
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
                                                                                                                                                                                                                                                                                                                                          • Size 73KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 5bb72a7575da17417233d776e3c2cd6ed3fbd61045e4ce2767927d07aaec0f4d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000073
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
                                                                                                                                                                                                                                                                                                                                          • Size 105KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 85de6a38d9b2ca5a3427d9d7dbae0461ef4fbdff7f7ee2e44445e86c97c5fb3d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000074
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
                                                                                                                                                                                                                                                                                                                                          • Size 29KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 08a53322d0e62e29807bfce56d3cea558d7499c21d6e730119c58ee245d9e85a
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000075
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
                                                                                                                                                                                                                                                                                                                                          • Size 43KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 e90e1fc1c623568fde6dcc82159e2909b921a944a06a070462657869fdf741ee
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000076
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
                                                                                                                                                                                                                                                                                                                                          • Size 66KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 fb87ad6f2e2a77c8376fcadd50ca4e1c07b8d5c6ccd89be6260dd074ed260751
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000077
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                                                                                                                                                                                                                                          • Size 100KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 e4f44c05bec75a620bfff76d6b353e2a21d216f399c754ff434f51e48fcf4bc7
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          f_000078
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
                                                                                                                                                                                                                                                                                                                                          • Size 219KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 20d53a7376764db1ae978a8dfb9b2af3546dc405b11dfa48856137c091452a28
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 95b5f1b3947519626a8341564343c40ed6e33161d36a38aaa37300d2b11a6ace
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          the-real-index~RFe5b0e16.TMP
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b0e16.TMP
                                                                                                                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 702c7a5310829f2baf1d450481f9bdf4746591f566df7c6817ee89d1b95576ae
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                                                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                          • Size 16KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 34de8c7dbce6435b0acf2acf89f43dac0f5c6879b3fccaf8e0b303bb7a737d20
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 c1c439ac01c41846ef47560092605e2e1f95c6ecf02beb633d00326889a5965c
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                          • Size 26KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b402593b2e75015a0262600b65bdf388689e12723275891fdb6ea4fe9a46581c
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 56e0096678d7361b6e775824c55628218e877297532b3e2f0fc2eda17791ecb4
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b2ae4ba4abe9d53ff801df4f720306bf9d3eae01cbb43cfa1099971d2e5f0d7d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 452ee110dc9d5f9e75e514041f0392e27279a5710450320f8591231bb06d04de
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                          • Size 94KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _bz2.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 84KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _decimal.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 265KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 64KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _lzma.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 159KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _socket.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_socket.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 78KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _ssl.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 151KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          _uuid.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\_uuid.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          base_library.zip
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\base_library.zip
                                                                                                                                                                                                                                                                                                                                          • Size 711KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                          • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                          • Size 678KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          python39.dll
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\python39.dll
                                                                                                                                                                                                                                                                                                                                          • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                          • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          select.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\select.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                                                                                                                          • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI18162\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                          • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          uaynk26k.exe
                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62za1js2\uaynk26k.exe
                                                                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                          • SHA256 818602018df2c0c7a9bea21badb81880807dd64aca216ad9abb93a5fb70269a7
                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                          memory/4936-967-0x00000230B5F00000-0x00000230B5F16000-memory.dmp
                                                                                                                                                                                                                                                                                                                                          Download