826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d

Analysis

max time kernel
59s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
Size 5.4MB
Sample260831-b812bsec83
SHA256 826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d
MD5 a4661e42ccc61ccab9e43440e51abcdd
SHA1 2dc6c56903a416b1c418011fdb89a46285acad3c
SHA512 b4259c24b9aa7aec396f8a961767d267c89f3e8c83a1b88d9a0096f8403706319d734298fe8a33c01014afc8f87ec8eaccac0a6fc5804f6ac8ef6f17084a6f79
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUC:E+ICteErownP0oTcMsABqlUutvd
TLSH
T1A4463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtk9sd.exe	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtk9sd.exe	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3cfv0u.exe	m08kt4ij.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3cfv0u.exe	m08kt4ij.exe

Executes dropped EXE 2 IoCs

pid	Process
5080	m08kt4ij.exe
4600	m08kt4ij.exe

Loads dropped DLL 23 IoCs

pid	Process
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe
4600	m08kt4ij.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\9tcn0h03\\8xtgbpu0.exe"	m08kt4ij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\c62xs99x\\m08kt4ij.exe"	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
344	ifconfig.me
353	ifconfig.me
1524	ifconfig.me
1937	ifconfig.me
3344	ifconfig.me
3842	ifconfig.me
149	ifconfig.me
202	ifconfig.me
608	ifconfig.me
3504	ifconfig.me
3905	ifconfig.me
128	ifconfig.me
3216	ifconfig.me
763	ifconfig.me
848	ifconfig.me
1247	ifconfig.me
2653	ifconfig.me
2825	ifconfig.me
3416	ifconfig.me
151	ifconfig.me
167	ifconfig.me
967	ifconfig.me
2616	ifconfig.me
838	ifconfig.me
3330	ifconfig.me
3936	ifconfig.me
803	ifconfig.me
686	ifconfig.me
2463	ifconfig.me
3012	ifconfig.me
4008	ifconfig.me
387	ifconfig.me
958	ifconfig.me
495	ifconfig.me
266	ifconfig.me
290	ifconfig.me
644	ifconfig.me
3398	ifconfig.me
3661	ifconfig.me
403	ifconfig.me
2302	ifconfig.me
2313	ifconfig.me
3681	ifconfig.me
218	ifconfig.me
484	ifconfig.me
1172	ifconfig.me
1316	ifconfig.me
2889	ifconfig.me
2995	ifconfig.me
1057	ifconfig.me
261	ifconfig.me
558	ifconfig.me
1549	ifconfig.me
2614	ifconfig.me
3652	ifconfig.me
49	ifconfig.me
462	ifconfig.me
1061	ifconfig.me
2508	ifconfig.me
3138	ifconfig.me
3637	ifconfig.me
3787	ifconfig.me
580	ifconfig.me
2234	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5704	cmd.exe
5804	cmd.exe
632	cmd.exe
6020	cmd.exe
6164	cmd.exe
6848	cmd.exe
8276	cmd.exe
5108	cmd.exe
3296	cmd.exe
2380	cmd.exe
7076	cmd.exe
5740	cmd.exe
10188	cmd.exe
5072	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 6040	4756	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	86
PID 6040 wrote to memory of 5072	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	87
PID 5072 wrote to memory of 3864	5072	cmd.exe	89
PID 6040 wrote to memory of 1992	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	90
PID 1992 wrote to memory of 5548	1992	msedge.exe	92
PID 6040 wrote to memory of 2036	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	93
PID 6040 wrote to memory of 5664	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	94
PID 6040 wrote to memory of 3488	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	95
PID 1992 wrote to memory of 1220	1992	msedge.exe	97
PID 1992 wrote to memory of 4220	1992	msedge.exe	98
PID 1992 wrote to memory of 4220	1992	msedge.exe	98
PID 1992 wrote to memory of 4220	1992	msedge.exe	98
PID 1992 wrote to memory of 1644	1992	msedge.exe	99
PID 1992 wrote to memory of 1644	1992	msedge.exe	99
PID 5080 wrote to memory of 4600	5080	m08kt4ij.exe	101
PID 1992 wrote to memory of 1952	1992	msedge.exe	102
PID 1992 wrote to memory of 5168	1992	msedge.exe	103
PID 1992 wrote to memory of 1952	1992	msedge.exe	102
PID 1992 wrote to memory of 1952	1992	msedge.exe	102
PID 1992 wrote to memory of 5168	1992	msedge.exe	103
PID 1992 wrote to memory of 5168	1992	msedge.exe	103
PID 6040 wrote to memory of 3364	6040	826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe	104
PID 1992 wrote to memory of 3240	1992	msedge.exe	105
PID 1992 wrote to memory of 3240	1992	msedge.exe	105
PID 1992 wrote to memory of 3240	1992	msedge.exe	105
PID 1992 wrote to memory of 3384	1992	msedge.exe	106
PID 1992 wrote to memory of 3384	1992	msedge.exe	106
PID 1992 wrote to memory of 3384	1992	msedge.exe	106
PID 1992 wrote to memory of 4996	1992	msedge.exe	107
PID 1992 wrote to memory of 4996	1992	msedge.exe	107
PID 1992 wrote to memory of 4996	1992	msedge.exe	107
PID 1992 wrote to memory of 864	1992	msedge.exe	108
PID 1992 wrote to memory of 864	1992	msedge.exe	108
PID 1992 wrote to memory of 864	1992	msedge.exe	108
PID 4600 wrote to memory of 5108	4600	m08kt4ij.exe	109
PID 5108 wrote to memory of 5200	5108	cmd.exe	111
PID 4600 wrote to memory of 388	4600	m08kt4ij.exe	112
PID 1992 wrote to memory of 6004	1992	msedge.exe	113
PID 1992 wrote to memory of 6004	1992	msedge.exe	113
PID 1992 wrote to memory of 6004	1992	msedge.exe	113
PID 4600 wrote to memory of 2412	4600	m08kt4ij.exe	114

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7120	attrib.exe
6976	attrib.exe
5200	attrib.exe
3460	attrib.exe
5064	attrib.exe
8976	attrib.exe
8736	attrib.exe
10736	attrib.exe
3864	attrib.exe
4884	attrib.exe
5804	attrib.exe
4776	attrib.exe
3876	attrib.exe
6344	attrib.exe

C:\Users\Admin\AppData\Local\Temp\826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
"C:\Users\Admin\AppData\Local\Temp\826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe
  "C:\Users\Admin\AppData\Local\Temp\826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe"
      4⤵
      Views/modifies file attributes
      PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffeb4a2c188,0x7ffeb4a2c194,0x7ffeb4a2c1a0
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9350047955624191847,9373070698356705570,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
      4⤵
      System Time Discovery
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,4984781006406359146,8105469310580173152,262144 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,18368594764842128926,11100305212961463188,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6158027340397127357,3966231230154674244,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7743326196029112502,5676770791496891344,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3460,i,9543319224304519351,13626314250027142061,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4668,i,1277919341058891337,3441548987774687974,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4812,i,16927813333647991547,3584429369588091292,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4952,i,6205944870118969372,12965774490223447661,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5612,i,8686649237097715525,16380238185633499626,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5796,i,6595030666645908212,16220118829741029516,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5956,i,5261342564010135101,17792197247616596422,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6208,i,12192499431339573709,4878191930067032904,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6388,i,11039306615077150339,17756615892955612854,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6500,i,10864142489450400172,15274890007210539203,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6704,i,10816390793725755641,10117670261933407163,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6844,i,12943964811092980195,6359303608848985180,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7060,i,10841440494125178084,14595464340719023081,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3456,i,16393904925416563025,11182004314618368674,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4636,i,17915868342589759193,9291557431246358192,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7416,i,17050231688837870467,3347588619760335501,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7460,i,5251299901543680445,10390226149813231168,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:6796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7496,i,14978347021416082661,17479884703799396547,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
      4⤵
      PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7476,i,16837433160515421639,6688488719272908210,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7488,i,1519754223820334805,18256532306660164084,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7504,i,7772500228393283741,18026935690697475371,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7548,i,322806447692341616,2975042031720506798,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7572,i,10281983496147875735,3716311803167959222,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10308 /prefetch:1
      4⤵
      PID:6888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7764,i,12515850082182575562,14901733474149628038,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10340 /prefetch:1
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7808,i,1853845773991116018,99745184143034900,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10412 /prefetch:1
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7760,i,14749315026537891678,5372728618110323177,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7844,i,9283096651931326096,13783671946900493891,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
      4⤵
      PID:6948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7856,i,11710794878318059481,17087245322456537400,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:1
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7868,i,1669732022648628839,10545144773458548734,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10532 /prefetch:1
      4⤵
      PID:6984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7924,i,15619063763235669306,14887314796651609833,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10604 /prefetch:1
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8188,i,11840415823244439378,6817604522403817717,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10600 /prefetch:1
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8240,i,12800756564962088375,112873732877345805,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10724 /prefetch:1
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8216,i,13542357011436430269,4050571027284156188,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10728 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8296,i,7156578127151209180,9668044586629971256,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10740 /prefetch:1
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8320,i,18368638598996368543,1461963704402739625,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10772 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8368,i,15215628186786433090,15802478935262027016,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10844 /prefetch:1
      4⤵
      PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8332,i,14642143814981668735,9015749454817392077,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:1
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8396,i,16696494860966596703,13477760996920310572,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10860 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8432,i,10539646108190510917,16148119158205240623,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10872 /prefetch:1
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6480,i,17620940677812741969,16881433460791454055,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10988 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6400,i,2594636209020011799,9522979525839659530,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11036 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6432,i,7348922813229404974,9943168306199242596,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=10992 /prefetch:1
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6904,i,7066192737397044462,17328615277697012959,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11008 /prefetch:1
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6328,i,10599219768806146563,3493027873871808394,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11120 /prefetch:1
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8444,i,4628503486754307811,10668103925039562949,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11160 /prefetch:1
      4⤵
      PID:7092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8488,i,15745091441677997494,10538996213691026205,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:1
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8608,i,3150487899365235010,1143911077069082246,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11232 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8840,i,15124678231972222475,7428976676282006696,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11276 /prefetch:1
      4⤵
      PID:7152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8804,i,11062906124631027146,4759414274300641609,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11288 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8836,i,17369359167044622447,5647605887341473977,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8764,i,11050711462501784371,13012310660018345995,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11380 /prefetch:1
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8744,i,11621666403574084300,17955395514615322493,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11384 /prefetch:1
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8704,i,11892912178219801102,1510199326929604320,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11396 /prefetch:1
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8640,i,12638936160819291053,4177210668103236609,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11408 /prefetch:1
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8660,i,12813520527429265645,10837985617147119967,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11428 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=9016,i,13550980447093196425,6053013176600987611,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11500 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8976,i,6684896337951923474,14685521214862221114,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11576 /prefetch:1
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9052,i,15246128225710203670,9793483475673903316,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11464 /prefetch:1
      4⤵
      PID:6428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8956,i,6277189765602142304,12858044836174743812,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11400 /prefetch:1
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8892,i,12400885270162452864,5607047416667211063,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11772 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9008,i,6573816109656857641,5707626440642301194,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11688 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9356,i,2440179098953650897,6246080935448449122,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11776 /prefetch:1
      4⤵
      PID:6452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9408,i,13277154854644688370,739504475042227784,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11788 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9392,i,2417610330525383510,13344756902993839258,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:1
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9620,i,4162370342487457782,7359591129800845393,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11820 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9616,i,10963708758704930118,18015393830597441932,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11892 /prefetch:1
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9644,i,1644546146525544519,8515718645169612507,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11856 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9656,i,17446706843168067603,16102212836061797424,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11628 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=9720,i,7092426119965972358,17546467392235798619,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11952 /prefetch:1
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=9740,i,13458713215747258857,6896004642202509417,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11964 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=9764,i,17873617706281888014,10499196173079184645,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11960 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9892,i,7273853707051934074,18167752523240451165,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12012 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9916,i,12556007326594220975,4571127446884142673,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11584 /prefetch:1
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9948,i,5495539874787855769,7190012326242852578,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12068 /prefetch:1
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9988,i,16587312415234553012,17001616416808472210,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12104 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9928,i,1334687098238163151,13122492783644627071,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12044 /prefetch:1
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10012,i,12195550649452332470,9639858241422022650,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12140 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10060,i,15169843002426561044,15173904277897354548,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12160 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10036,i,7062879547618433512,5620777248072861726,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12196 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10096,i,110872237095159375,16683360579439625292,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12432 /prefetch:1
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10080,i,17338968256359855472,1758225469302758414,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12252 /prefetch:1
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10152,i,16798469056953386743,3802847402252278511,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12272 /prefetch:1
      4⤵
      PID:7172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10168,i,7303384167081420360,10320761490313129402,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12440 /prefetch:1
      4⤵
      PID:7180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10204,i,2869205892199778265,12005287686546467029,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12460 /prefetch:1
      4⤵
      PID:7188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10228,i,6691585620866984341,18435997794225157489,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12480 /prefetch:1
      4⤵
      PID:7196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10252,i,17734772707110733273,15019929957967256817,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=12500 /prefetch:1
      4⤵
      PID:7204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=6452,i,6077070617573050985,3062580056263768154,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=19760 /prefetch:1
      4⤵
      PID:7820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9916,i,18342115226927414375,5448832228612680349,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=19836 /prefetch:8
      4⤵
      PID:9000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10256,i,15772876026678081380,11417772355045934291,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=19700 /prefetch:1
      4⤵
      PID:9148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=19684,i,17769331325205998379,7059105794923866865,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=11108 /prefetch:1
      4⤵
      PID:8656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=7784,i,16467901278090820838,6932814479155327854,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=15408 /prefetch:1
      4⤵
      PID:8964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=15444,i,15273918476446407549,5704495558774994198,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
      4⤵
      PID:8696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=4820,i,2583270679387545284,16301330776941581774,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=5948,i,4373239972309118828,7983540795023393764,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=20132,i,11931395386635224376,7896204128353233253,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:8944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=6900,i,16076913285679693525,7753056193475310515,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=19556 /prefetch:1
      4⤵
      PID:8860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=20404,i,17290063340197615283,8798179228925190393,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=696 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=20548,i,3493622550089024313,17878828721821166421,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20576 /prefetch:1
      4⤵
      PID:9244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,5979950297112071804,14829805379401036119,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=15376 /prefetch:8
      4⤵
      PID:9268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,6556919734934864602,3836137235629864749,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20732 /prefetch:8
      4⤵
      PID:9276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=20692,i,14338158365709404408,909645666257091598,524288 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20768 /prefetch:8
      4⤵
      PID:9284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=20848,i,2618089306618740442,9690746865491576013,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20844 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=21052,i,5801733825900406859,12590164528772987134,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20704 /prefetch:1
      4⤵
      PID:9968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --metrics-shmem-handle=21188,i,462005140312005855,2883652832204313178,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=21172 /prefetch:1
      4⤵
      PID:9980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=21220,i,9635648695515387465,15576704674149054915,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=21364 /prefetch:1
      4⤵
      PID:9880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=21540,i,3527303978007154535,11575012155676179950,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=20696 /prefetch:1
      4⤵
      PID:9756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=21528,i,513048396708253859,15364021069913116819,2097152 --field-trial-handle=2336,i,8325002793191458927,12299664119441184003,262144 --variations-seed-version --mojo-platform-channel-handle=21668 /prefetch:1
      4⤵
      PID:10260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3364

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe"
      4⤵
      Views/modifies file attributes
      PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5692

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe
1⤵
PID:6104
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9tcn0h03\8xtgbpu0.exe
  2⤵
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5704
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe"
      4⤵
      Views/modifies file attributes
      PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5720

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe
1⤵
PID:5572
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vh80jrq6\9jfjuvdp.exe
  2⤵
  PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3296
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe"
      4⤵
      Views/modifies file attributes
      PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2416

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe
1⤵
PID:3764
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\a7fbmli3\edorjz20.exe
  2⤵
  PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2380
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe"
      4⤵
      Views/modifies file attributes
      PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2392

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe
1⤵
PID:5096
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4hza5geh\sd441hhw.exe
  2⤵
  PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5804
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe"
      4⤵
      Views/modifies file attributes
      PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe
1⤵
PID:2492
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wuronlya\ohpzyutt.exe
  2⤵
  PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe"
      4⤵
      Views/modifies file attributes
      PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3872

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe
1⤵
PID:3024
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q1mf2v8\449l00lu.exe
  2⤵
  PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe"
      4⤵
      Views/modifies file attributes
      PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6556

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe
1⤵
PID:4072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n36pp71p\yhnug7jd.exe
  2⤵
  PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe"
      4⤵
      Views/modifies file attributes
      PID:6344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6884

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe
1⤵
PID:6896
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p7hqyvk7\lpssak6e.exe
  2⤵
  PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7076
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe"
      4⤵
      Views/modifies file attributes
      PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6680

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe
1⤵
PID:6732
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd5wxyzf\zd88obeo.exe
  2⤵
  PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe"
      4⤵
      Views/modifies file attributes
      PID:6976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6460

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe
1⤵
PID:6652
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\stc7ivly\2330dvx3.exe
  2⤵
  PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8276
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe"
      4⤵
      Views/modifies file attributes
      PID:8976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8940

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe
1⤵
PID:8968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qeyfgjp9\yo5wro5p.exe
  2⤵
  PID:4564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe"
      4⤵
      Views/modifies file attributes
      PID:8736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8800

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe
1⤵
PID:10180
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8m1j319\dkz2hpez.exe
  2⤵
  PID:9912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe"
      4⤵
      Views/modifies file attributes
      PID:10736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:12148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe
1⤵
PID:12036
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d7vl5brj\6yu0yj0l.exe
  2⤵
  PID:12240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 298KB
SHA256 9f16cfc50d767313590552d6130a27fdf473f963abba1aee5891ca7e2a60e224
MD5 f52a30fe51f89d0fd8465bb0b35bc577
SHA1 8f0b205e69170a91cb3a2fc144a9542da356ec46
SHA512 f295923d639231f6023b8fea955717dd160020e9095ab203d0496f93f2514e356afc165fa548beb2b0c12c0aa1f47baaa1d45826a9ce8a4fe32c4d755e9290c2
SSDEEP 6144:q8va6/yQTcefZMYxVoGfWd+sJYt9dQm4r3q+Rp3V2y3JsbHFVagnkblIn71:DmQfxMYxVo6y+s+tora+33Ey5EagkRIB
TLSH
T1415423FCAC2678FDB7F0B2A18DAA1DA3F6DD340481EE6B741A584C063507EC5942267D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 75KB
SHA256 3b4b2fc56d46b5c95f4d2a790b21221bf4d3cc3e6c14ce66a2e2c249da27ff26
MD5 84c6c466a288b666c9e37601b684e27b
SHA1 5671728eddc4cbbe6e6847e0910a7b1fa08e3d93
SHA512 e8d093ed618e1a909794d9c3c117accf2bde6729607a677c0744dad6a0a8a35b8e60cd45bbbc5fdf8b6e07882f30908364113637b9de105a276b29142f693ca1
SSDEEP 1536:CrNnWXhhcu0kiKWMGWHO/B3VOPE5tZpUF3zNJ5MHHwbYoXLjSh9cEPI4nB:CrNWxh70LKWJBFJZpszNJ+mHj29DnB
TLSH
T1707302DBB407EF1FECFD5BD64A2A0D838B1F5B222681444B30BD49F6E379E942448295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 37KB
SHA256 bc5217175df294b1e6130e10a229aa60a6b4ca513f8a5f8097fdb2499a42d8ee
MD5 03ac1c18dfc796dfc86cb1fb73def799
SHA1 399939e731a2a0eeca7b5660fae4956b517662fa
SHA512 80cda9460d6090a908cbe98b39eeeefda5e021918775f589a575d8a038235c41efea6026195596a737b6b414db6ff77ffcbda1e01e3c3e8fc7e5f960d8df550c
SSDEEP 768:ot+F7nWSjcVetEohhO4W/76OIP3y+rNIOp3kaRCona7YsAv34A:ot2bWctm/763PRFD4xkZfV
TLSH
T1E903E1EC6986BD980C019D01EEE97109B2361F2433DF6FE0C60D72AA97D868DF1C9617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 327KB
SHA256 2b1e29c1bc661dee9ac1e5994b7414708b8da0edc191bf4a66cf58449c99649f
MD5 c86e496915254412df0473d1192fafde
SHA1 faf8006d53f57745c819c8cc874bae3db73c4cb2
SHA512 d8e3315f1b9f329b5962ec68b22ca4a5e2250b418cd69bbea20f4ac46a7752fb2b17ed846200d4f023dfbde857fbdf06b794912f65d816f106225801c55c53b0
SSDEEP 6144:GXlyRhUwslEWJt8k14kprc3yNMqj+FBubSQjf81Ym6soo:TUwsrB14orj+vubSQL8l6soo
TLSH
T1F26423554BF6D3212850E16B8802599A32C8667C2F51F81DDD1D773B01BBB8AB1A8FC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 69KB
SHA256 4ff7209de81681d6d7e38aebc78653798b3d808ef0e32cdd021bb69513dfba2d
MD5 7daece975e1859e0ed59170906b8da36
SHA1 25b9a34a7da22ec84e566ce3b78bce2d04b16978
SHA512 82f5085b3f6d21cbccbf31aa98842e9e29a5a77b0701f049ff937ab739275447290cec59f6c8f041027fc77c1a303e87ae2097b2efbcd056c3aee453dfadd6d3
SSDEEP 1536:/tD95yacit2VPPZDukTLaswd/CNkXyYh0JcQKeqaD5ZrvQspi3jU:/t95yacY2Zwk3twd6UGpDfpR
TLSH
T19663129ACC0DDDC01FAF2DBFBC9FD4749DEE295217847C8B605651260309A212EC2B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 219KB
SHA256 e46407337cb216090cb833f6a4aaad5c56a8ba5a7a23e74bbcae14a098710e25
MD5 c87a1319844223bd2e5b019f12642918
SHA1 b965107a6632ebb042319bf85faa7366101b11fe
SHA512 13ce606932206ce5214376e7a016424c5035a2d3580d7aafe033aab270020f64d4f058379567a54cb0230e71aca5f00f409c21f0aa897eed9567e8f8e2f2cf13
SSDEEP 6144:YoRBZFCrEMdEQcBplrkiyv5gtdAnyedqRiDrZA8TrYpMtt2XCC:Y8bYrEMdDYgie5UwtkR8VzvYCC
TLSH
T171241382E44D39019DD853FEA2AF3E41AD068A05DD8F76A46F822425FFDC68E01B87D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 100KB
SHA256 89cd52b4978b59ea81b1d55c7ea8bb9b3f13c25b833688ec7decd40251d5a45f
MD5 6173b3aa60d98d8b85413cdc17621af1
SHA1 fb29809de2cc6623021dbcf9dff35b6d343428c0
SHA512 02ee51b292ca20ba786f9ac608d6c3cdfba6b32881957b22688745a37710550d99a3124f36b00138f47d9d1de4728cf9328a9960dde34a7841ab97d9da749ce2
SSDEEP 3072:AU8ImS+uukQLnEdBqzp+IK9hWiCeC9v4Z1vCYWfjtx:AU4S+uuZ3pjnijCyqZrtx
TLSH
T1CAA31264B65EB837416980A4F76EDA2C7B7F41C08875C0F0E03EA116618B7F3D6BD265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 49KB
SHA256 fb114124cbfb4b52a0f42ba5387d3fc21083d378b8c147f0d8513478e51206d4
MD5 e1cc11da3b27dd79369e88302e2f5d46
SHA1 7efce266ca463a03226bb2feec82530147013c9d
SHA512 c30aa0d611323cb9127b9a48a8e8774513c2d474509adba61f4ea1d409523dfbf3b7cfc8e1c39e7ccd71db87e13b3796ee64e4cfd96d62591317047533f52880
SSDEEP 768:o+DfLblC7k3UQ4ERyv52atwPZoOKim2yuWrKOBA/AxBQOAZExDoiWiyDPQN3xv+s:55Kk3UELoOKH+YNlAaxD7wY8fIof8yB8
TLSH
T15133011A63D110D2F6EE8BB262651347CE0828D9FC5FD0493A572EB5C8335C273B49AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 36KB
SHA256 4018de391c54699ca3450cfe46f6a061a98886e5dd8c332dc8b744804bf14310
MD5 aa2400b50e83c5b3d1ee61214d7b9f76
SHA1 e65c1f71d4641f072d3c05229fdad014218ab580
SHA512 bb26d7f7670c2e4b0fdf977ef15c1d28ffea3ce2f3721eeefd88706cc8470103bac1f91f76c6a9e4968dc14a07efaa176bcd79e34c8ac93fad8ef109862dcc93
SSDEEP 768:FOl2CIaE4ln8Xy11Qz2KHvvjF/6ziGMGF5/pGVuXKQc7Q5t8:FOl2p/4ln8XyDQztHno5Ag56
TLSH
T119F20206E4F6AEEC563B8D6F521F82D21005EA149BD322096ACF4FCF0B536B85A3D035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 32KB
SHA256 37d636331f30cc5e3fea1ca983b7b86bc0edd15afcd9df770cfabb776d222bc6
MD5 bebb1a7c9f277a96fd91d63deb5dc556
SHA1 301296d54a5606fd2f68c81d42bf262e2ebe55e6
SHA512 ea092b70384b25ac6833140a0435dbb8201e9eca923eca40a6bb9d4da9a2a5a635ddff6a8bfe8eac84f6a145a79fba48bcb22193e34dee38ab5e23e4144ab7f2
SSDEEP 768:fCQpNnwUctPxEVRI+7Up9V/3XBmlkdoc3h95O:fRNnePORI+oB/3xkejA
TLSH
T124E2F11C7DD320B55346EDA56C273B2DEF855B502E6B97314904A832184EEA31FE9D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 26KB
SHA256 a983e0f95af54b58e1a15e228c06799be82f0fae9debf3afe8d5f2d1d82fda08
MD5 f2a2b3c1bb190cfe7c0e6dd0e9b51d71
SHA1 c24b7cd9218e600c890c30aab9cd5f19c14efd57
SHA512 e3d26c4e041eff323c6ac2673a81512cbe5e066cf5e43d90125a33ea7ab73c2d647c9abce44b0f859b1ed25ae3d654ed552cda0b2cf76dc55616aa05feaf7463
SSDEEP 768:QBN21TdIzYV1EG27V8ASjtyq1TcA25YBT:ngYV1J2ZWyq1J0YBT
TLSH
T1C4C2E177EE69034D8AE43C2A4E0D51784CF57B9F2C16FC806B15B81496E0EA729FBB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 106KB
SHA256 74840800a3113c01c1432c0905d88878db55f811b6e3cff3870a5f16c27bc24b
MD5 99a312a5b29288413481fa2e8151e979
SHA1 118cdb0fd7fa84371ff67fab58bc84dfec19951b
SHA512 d6b3e7b499dd45a6bec42f6e60b64be9c217fd11ba0cb813ed5d4788f96be3e874cf9c32d617df2a7645e389c6183326244ffab6d7b5a0444696357ab92f83d3
SSDEEP 1536:6mZg81jJaRCzk3wd7MyNhf1A292tZJqos1I3L5QiOl1uxS1dh3fHeSrTPyxzKmVl:6mb1tRfdZH9MZ0fIFOl1n1dNfH8+S4g
TLSH
T1F8B31246B3B6456EC7732F37ACF1680460DB1A2F01D6CE5A24CD9F0B147A2AD51AD0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 43KB
SHA256 e90e1fc1c623568fde6dcc82159e2909b921a944a06a070462657869fdf741ee
MD5 17ef6cf1c2a72a5fe8fed0ce41fd07d5
SHA1 e5ba686e1567afc2e40c1b74f3ae58ca126e05fa
SHA512 26e9c3ab4d9babe4a300f6a5681349f94f3f2623436b6abfba17f3b7367e207ed26034d3a1149dcc5291f7f44ae269d7bcb11f1560234324bc685ffc5e20dcec
SSDEEP 768:MBKXzmV+q+SiYqVZExVhR1kM6XHgteD7zDmWnMGUe/Wv+VxifSKy6:MB6zmV+xbzZohR1BoAI3JnLUf+VxCy6
TLSH
T1BD1302C18160CA9CDF7B8B627964F3F23DFD2119E8C89B1551D1CED8A836917432A3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 66KB
SHA256 db5025c4858f84a97b14b00d32da94a04b67329b368aab8e3c56ec8708ea8b1d
MD5 1f7f4829ed1ce2a6723c35a5fdbe24ae
SHA1 f0ca771ebe166d1c9c1f90cbf91e1be055ba68fc
SHA512 9ec0cb61f24f2dc0c8b337f028ce28ba4e2173e89870b771b61d4c8d90c90c88acbf55fd5be11c3ce645d424d67f6e28437fe1480d2956c07dc60be5979b5ff5
SSDEEP 1536:Sqs1o9/MsSt0N+2JwbNrqRHeLfpaWjAK1ggaAfnlkL:qodSiNBUddFSgaAmL
TLSH
T1646312A19EBF386EF17BB8E4144C64C13DC7D97A1CE8F181139D82C266BE7586B20875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 29KB
SHA256 08a53322d0e62e29807bfce56d3cea558d7499c21d6e730119c58ee245d9e85a
MD5 60eeaad3439a63bdf7de556a4e0e6ea6
SHA1 6c90a14456c5737b7986419828db8e0d49043595
SHA512 a37d47176dcf5ef0d90f2810d3c6dd87e67393ec8b8fb33e71791136eac960f2b02a8f5ab48d4f292827bbd3f20e0d99af7c700b6b7976605adb8ec8e1aca50b
SSDEEP 768:fQO0UIaFnfGMCxnnY2AtKaglzoJWsKIQ/PAyhIG+:fQOPIYGMCxnnN2q1URKxXAy+H
TLSH
T195D2F1524F29EEAF5868276263404766CA14C81DCF02DBCC4E377B97BEE49683274B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 21KB
SHA256 8f905bda61aebfbebe76c37d67e7df7b4597c39edba671403f2e1d791df01635
MD5 c8866edc740679a2cccbc27d42ed8cbd
SHA1 c328a8b674e570e0bc8417d9d5b13a0706d0f70c
SHA512 5c56bea9b6fc070ab1948f3a6b0299d589881d6267e2d632b20daa61447310413e924f2a889f69739e8566e611055184d958c836d65ae71693e03dc14dddd890
SSDEEP 384:XxVB4IqWYBMXlBAk1inkRf3apyehettW4T4ZOy20eUylN8alpf/A:XHB4xXAlpG8fapnSW4T4ZSU2Nd/A
TLSH
T1A2A2E13CD855FC8A1DC7E3544C24BAAF62989EF4995C564190530B2CBB78F18DD4CA88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 92KB
SHA256 38d943c07bf3c12f3ac963cee845b7c3954d77c38493691f3743574e4b1ef958
MD5 6953aa70ecc497327e977a79afb5ffde
SHA1 420779231eb8529b06547895d2826cff56968ed7
SHA512 c7d72b72adbe4387db3a70aa51d36d2a9101209e67344a92f331e3fcbc291c461ac9df1157fc7168a913823c3a3b286c75076832c8f88e950c4902202b6b3fcd
SSDEEP 1536:4rB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwtkvLHC028:0+dCdU1UKok0HaFA9wRw0YuoqsmGeqDK
TLSH
T1EC9312F8D35E738D8131DB3D579C80FB00E609DCF924E38B1A5C62CEA53A8A88476853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03b67b8de3c53bcc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03b67b8de3c53bcc_0
Size 78KB
SHA256 2a747990837f81a57539e1fd9df67d015c1001f4d9346f62e3d4045af87b3dbc
MD5 323fa706a9be8ff58364c8aa1afcee03
SHA1 5e3a62770b90d72eb063309c082d8095c0c17344
SHA512 f5c615586d70ec38be0a55023e25b0c526b77cd208982ddb6433fd99eded1571554bc250f21ef0eb45fe6c2814dedc41625de89226e126714f807e87aafc5361
SSDEEP 768:5gK04qDu8Epi/8bR80HE8XcpokJX6XtRcP+dhbAFBqUyw7einI2U7+BtSUF:5501Dgrm8X7k5gcPKAFBqUy4I2UaH
TLSH
T1FB73D7491750AA96CD7A63F411E78517A33581042EC7E72721F4E3363C8B2F26E9BE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

282bd5c2a10676c1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\282bd5c2a10676c1_0
Size 270B
SHA256 058cc698a749d8c2d8acc2b795a86582f8ee16ada6d3f2fca651415ecfbb4a30
MD5 cd09703a46e5e2f40537fcc3d31aa1d0
SHA1 806009f33de1f67802dc129effe60b63348d0d7e
SHA512 6d7211fbdc8d7da6984c6f3ac7a6ad82e9c46bb1c7096cae067738c448d4de20e0795cae95fb63a8d483526f2155b7f9e29402551cb939aad378116eb0fedfb3
TLSH
T13CD02BA751486454DF3CCCF0CB6F55179063D01585D840A0C10499B63517E307E4D160
MD5 SHA1 SHA512 TLSH

Submit Download

93f2530b3a52df52_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93f2530b3a52df52_0
Size 602B
SHA256 a1a02af4de78a31b835bb0f083cff70f28c8173e9ce2df6b46ed29f84dbb129c
MD5 77fdad5cca9b139d4b835e7d187d631e
SHA1 10aef1f8626eca149efee0ed55f076c8f3973cca
SHA512 fe5f14eadc216b4c66119b73600b6fb98012f8d9aec9d70a4afb512179a894ebc370aba8a8cf131d94786922bbe35cd70802b689ab8fd17b35ea36315e39402c
TLSH
T130F002C3010CFD55F56E4AB4D6DA955AC232D2A9D6AD0294C41091A32256B29721A5E0
MD5 SHA1 SHA512 TLSH

Submit Download

a20af7228e168a8c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a20af7228e168a8c_0
Size 289KB
SHA256 ad11f077ff4426419ac97d52c7bdbf06829014adcdf10ee8fe6d6604799f98c0
MD5 9cbfb08680122d42f4df703a85068125
SHA1 e7e60bf8296c7ff240ce943d05ed6cc434653a4d
SHA512 9231511b564951f7c751c32fc2631802ccbca9ce8273502ea9af0c631da274c5e1324f0262f70a777bf6be4a3d3c0efea211a57995079760a0db2debb9ff5c25
SSDEEP 3072:lOfuwzFYUejUDqKi9rjf3xeWa4ail/KyFV8v2b6GR+sU1P+Oif2p:ll4PqbhPUWa4a8/Kyv8v2EswWOif2p
TLSH
T16254B6551B90EE15CF7663F50262C953A73590483FC7E31371E8A33A2C5A2E25F9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d3e8ca769915822e238af47fc1d8ff37e63588b6202ddeda903ca089106ea87
MD5 da7e1214605fb9a8977884584daeb519
SHA1 85cd1a4db0516be2632b4c70492f4ec6bd0f7c9b
SHA512 66d182ab8c2886ed43868c2e2c70bdd7836bc7a14e892c5d93c70a5d3d36ef3ff086648ea745abaf4a2bd2817dba4cd307340647a8b47b70dcab23164a736b6d
SSDEEP 384:sxZWR7O/fQsyAzIKYnBPQMblwNgAfbrdC8:suRO/f+AzrMbWbrr
TLSH
T1E472F906AA345A778DD7D219F941BB53E3F5056295904E44AAFCCF1C00EBBEE220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a6345c015a3b7925544e96def2a5ed661d90478edd4a0b52ac935b753353056b
MD5 33c0695d6fa936682b908fa032698cf0
SHA1 f6d5734d13a3d0cf69ccff7fb2b5ccf4d713430c
SHA512 70d97bb724bd0f6ea68010bb2f3327837489ffc9831bd04d1a4ec3db747354f79b87972327e5ff613d2edb4178e7547e804c777d12fa76a957b9904c0c2b180f
SSDEEP 384:sxZWH7O/fQss6TazIKYTGMbM91ofIrdj8:subO/fo6TazLMbPIri
TLSH
T1D972F846AA345A778DD7D219FA45BB63D2F50163D1904E44AAFCCB1C10EBBED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 cc9e793ef078f16169e918502fdaa08fec8638c6e0d8caeea5a4b14fca7f6e11
MD5 14b8fea54f37c8b709c6a42c81eeac40
SHA1 3fb906f1ebad64929d57e99e21ab9bbf5dea67b3
SHA512 49231cf04046dc7cb92c363bf2044265116d96e4b3189815840814df1435cecbf6cab26ea5aafd84ac419141825571d78d9200d7621a6edb8712f6da9d6c62f9
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyysy10Llj:eY8Od/HEnFhWvFvmXu1jaet10Lm2Nupu
TLSH
T114F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6d56ef17ed82f6077b1bb76706e3d0695e8a0453edc9838321d8ebaee5324008
MD5 d614eafb405cd272a77360b9f5eed9b0
SHA1 84e81bb634c699db4933ab187321ec49850d8624
SHA512 31645a65832e20acfafbd489e5e88dc314fb29ff08d2c6ccb94d0e2862e84904149c3017af336cdafa218ea19a51edfc7b9e98fd3813c9f530faae101668d6b6
SSDEEP 384:np3iF9CcmyWCs3sNC8TUNTUlIm2QckCr9l9Kpv4fxGgxiz0yJUH9epwe4KV8p0us:pyFccps3fwgbkUbkkGgGJc9rI8p0YM
TLSH
T1C5B25A36EC58DEBBEDE34F89B74A7A07DEE0126785D85AD4DAD85E0D00871DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6180cd0110ca29dbb0cc4d20130e19c11a80f9ceee48a35fa54bcc4c84ccef03
MD5 01a74a6de55663b002527563c55f007a
SHA1 88a6c5e750e36542599ded08d8050276ca1e5545
SHA512 0a8c29eb488f65d9b9c5d8990435fbd1c75d98dc39ac18e8ed704b792457d8fb51aaa51592ed1e710a7d4d3c1ec585d2e770d40daaa692a39923a38729cf19dd
SSDEEP 384:n0iF9CcmyWCG3sNA8TUNTUlI48QckCruvxcpv4fxGgxiz0yJUHcvrBZd/ty/7Igt:PFccpG3Vwg5kBxqkGgGJccDrd4
TLSH
T1ECB24A35EC58DEB7ECE75B89F74A3583DEE0416388C88AD4DAD95E1C00871DD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c4e6ac2859ae4f856cd3953f3b2a056eaf9f813dcded1ed513ad5eba18a1ae63
MD5 49420bd44b98f04a3d536679a3d1b9a1
SHA1 1244e16f1a0445b4f6acf1a31f50eab1111d5e37
SHA512 3e16479c2eb5ef859227384c54d87abb59ee80a76b3a7dc4b27d1ba0f52a8f4800fd5a5c911ffe4e2643b964a81a67e5642cf16673d9c02b6576fa28aea521f9
SSDEEP 384:npYiF9CcmyWCs3sNk8TUNTUlIm2QckCr9TJ7pv4fxGgxiz0yJUHcvrBDde4KV8pi:pjFccps3lwgbkUVVkGgGJccDZdI8p0YM
TLSH
T1DDC24A35E858DEBBECE34B89F74A3943DEE0526389CC9AD4DAD95E0C00871DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 1e361164aa4d6a760b4f249b2f1e5d46c07e1d5840db331844c5f705d28b687c
MD5 4dfd943a17d33f77386c0af43c119a3d
SHA1 ba387a7290d66d5136ed865eb797700e6498cbc5
SHA512 f6c5fa9b5cd41b75751c1995399a0e0b8b8969ce4e77e772432d21aa154cf86a9704dbf0e0a3bd59c016e45cd91f0f6a89bc4fc30f18ebf7f4793de6c9fbe020
SSDEEP 384:n0iF0CcmyWCW3sNA8TUNTUlI48QckCrEsx8pv4fxGgxiz0yJUHcvrBXd/ty/7Igt:PF/cpW3Vwg5koxKkGgGJccD1d4
TLSH
T168B24A35EC98DEB7ECE75B89F75A3683DEE0416388C88AD4DAD94E1C008B1DD130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 309079dca930b07c89b8df686f4f094d06eb860eb3fcdffb058caa8626730732
MD5 bfb1627cc1deeb56da6237eed0db9e4a
SHA1 8eb087927fe98a3f357d8f1522a25edc56a88943
SHA512 d38d5d8c470a5eb6ea5dc7811d80bb304a7b3a4aafd21c19fec29d5a6d4ca49de2f2545dd4d2aae7b4da4eb0d1b1a7ba575cc9f936b9297eeadfd58b71a9bf9e
SSDEEP 384:npYiF9CcmyWCs3sNA8TUNTUlI42QckCrcoxapv4fxGgxiz0yJUHcvrBDde4KV8pb:pjFccps3VwgtkQx0kGgGJccDZdI8p0Yp
TLSH
T139C25A31E858DEBBECE34B89F74A3943DEE0516389CC9AE4DAD95E1C00872DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 041107ff53aee87e8b202e68b996eb23238eba57c9b49ab8a3a2d004a21a88fa
MD5 34d335c54183922c31f4e0494c137e4f
SHA1 b5ad19d662bb90526da9c389cd02e85994d117da
SHA512 2e52cfa0f99599d673c3be53476bb3f3f01c456e2214e3bff4ff292ebad49c286f21b89b3ffe8b8d8ad0246efa4564bf3e2f53dc93a5a20a7c3670596e614918
TLSH
T123411D48A6F91148B3B77E5B6FF6A86D447A78372E06D45E10110E4F0A62B40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\base_library.zip
Size 711KB
SHA256 8a83ecc21cee6f9af303b2e03eb3b88cc86663455a6636ab288381ddc8afef2d
MD5 0440f4aa9429ce96e9dfe534a3bd4e2f
SHA1 523c84203b2889008830a00d813c1276cbb5835f
SHA512 f418b2d04b1f0f2b78da1a387ed6dc6bd46a2cff9a38dd27792fa44dbdfb559aa5464f9b41862db2d7d0801528d641c2e7c1961986cd214c5351cff6401e0a23
SSDEEP 12288:tHV0cfk10axJkldphcfyEFPl2osQNRs54PK4I1OoQDSDS:pV0cfjsJkldMfyEL2osQNRs54PK4I1Or
TLSH
T1F8F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47562\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m08kt4ij.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c62xs99x\m08kt4ij.exe
Size 5.4MB
SHA256 826489f2de83f6d9315be0856f28eec602ef9b5103589eaadfa552ad8f04ed0d
MD5 a4661e42ccc61ccab9e43440e51abcdd
SHA1 2dc6c56903a416b1c418011fdb89a46285acad3c
SHA512 b4259c24b9aa7aec396f8a961767d267c89f3e8c83a1b88d9a0096f8403706319d734298fe8a33c01014afc8f87ec8eaccac0a6fc5804f6ac8ef6f17084a6f79
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUC:E+ICteErownP0oTcMsABqlUutvd
TLSH
T1A4463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5328-862-0x00000294AA3C0000-0x00000294AA834000-memory.dmp

Download

memory/5328-1439-0x00000294AA3C0000-0x00000294AA834000-memory.dmp

Download

memory/5328-1157-0x00000294AA3C0000-0x00000294AA834000-memory.dmp

Download

memory/5328-1522-0x00000294AA3C0000-0x00000294AA834000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads