8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4

Analysis

max time kernel
47s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
Size 5.4MB
Sample260831-eqstsaef24
SHA256 8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4
MD5 25122714f5bc2b7fd605f2317489e544
SHA1 3986981047490bdbddaae88cd5a2a10324ed6930
SHA512 d898823b98c172030111787dab40b5362302fb468734fd64dee54158199d17d3249311a6703ae0160617e13d3cf4c8f9b2dc348d1357e5ea2767c10b466e8f4e
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMK:9XhICteErownP0oTcMsABqlDQkD
TLSH
T180463308B3A80DE1F9B3D13981665621D473B4254BB0D1CF43AC9A662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m1vgym.exe	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\m1vgym.exe	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe

Loads dropped DLL 12 IoCs

pid	Process
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\msamtry3\\gyjnmshf.exe"	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
6	ifconfig.me
207	ifconfig.me
301	ifconfig.me
332	ifconfig.me
498	ifconfig.me
664	ifconfig.me
853	ifconfig.me
2250	ifconfig.me
286	ifconfig.me
449	ifconfig.me
514	ifconfig.me
696	ifconfig.me
718	ifconfig.me
892	ifconfig.me
921	ifconfig.me
1588	ifconfig.me
125	ifconfig.me
235	ifconfig.me
272	ifconfig.me
399	ifconfig.me
420	ifconfig.me
464	ifconfig.me
1384	ifconfig.me
1626	ifconfig.me
2123	ifconfig.me
2240	ifconfig.me
2299	ifconfig.me
2304	ifconfig.me
2537	ifconfig.me
2543	ifconfig.me
2795	ifconfig.me
2938	ifconfig.me
1554	ifconfig.me
1624	ifconfig.me
1833	ifconfig.me
1891	ifconfig.me
2479	ifconfig.me
2764	ifconfig.me
7	ifconfig.me
158	ifconfig.me
184	ifconfig.me
195	ifconfig.me
271	ifconfig.me
377	ifconfig.me
1797	ifconfig.me
162	ifconfig.me
425	ifconfig.me
772	ifconfig.me
1415	ifconfig.me
69	ifconfig.me
247	ifconfig.me
497	ifconfig.me
695	ifconfig.me
1087	ifconfig.me
1354	ifconfig.me
311	ifconfig.me
1113	ifconfig.me
1445	ifconfig.me
1505	ifconfig.me
1529	ifconfig.me
1545	ifconfig.me
1952	ifconfig.me
2150	ifconfig.me
243	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7900	cmd.exe
2364	cmd.exe
5152	cmd.exe
6732	cmd.exe
6648	cmd.exe
6412	cmd.exe
7496	cmd.exe
868	cmd.exe
5256	cmd.exe
5472	cmd.exe
2716	cmd.exe
6380	cmd.exe
7004	cmd.exe
2396	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3012	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4104	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4844	1236	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	82
PID 4844 wrote to memory of 868	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	83
PID 868 wrote to memory of 4128	868	cmd.exe	85
PID 4844 wrote to memory of 4104	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	87
PID 4844 wrote to memory of 2360	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	88
PID 4104 wrote to memory of 4124	4104	msedge.exe	89
PID 4844 wrote to memory of 4900	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	90
PID 4844 wrote to memory of 2556	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	92
PID 4844 wrote to memory of 3372	4844	8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe	93
PID 4104 wrote to memory of 3012	4104	msedge.exe	95
PID 4104 wrote to memory of 4956	4104	msedge.exe	96
PID 4104 wrote to memory of 4956	4104	msedge.exe	96
PID 4104 wrote to memory of 4956	4104	msedge.exe	96
PID 4104 wrote to memory of 1500	4104	msedge.exe	97
PID 4104 wrote to memory of 1500	4104	msedge.exe	97
PID 4104 wrote to memory of 228	4104	msedge.exe	178
PID 4104 wrote to memory of 228	4104	msedge.exe	178
PID 4104 wrote to memory of 228	4104	msedge.exe	178
PID 4104 wrote to memory of 224	4104	msedge.exe	99
PID 4104 wrote to memory of 224	4104	msedge.exe	99
PID 4104 wrote to memory of 224	4104	msedge.exe	99
PID 4104 wrote to memory of 5044	4104	msedge.exe	100
PID 4104 wrote to memory of 5044	4104	msedge.exe	100
PID 4104 wrote to memory of 5044	4104	msedge.exe	100
PID 4104 wrote to memory of 4196	4104	msedge.exe	101
PID 4104 wrote to memory of 632	4104	msedge.exe	102
PID 4104 wrote to memory of 4196	4104	msedge.exe	101
PID 4104 wrote to memory of 4196	4104	msedge.exe	101
PID 4104 wrote to memory of 632	4104	msedge.exe	102
PID 4104 wrote to memory of 632	4104	msedge.exe	102
PID 4104 wrote to memory of 2200	4104	msedge.exe	103
PID 4104 wrote to memory of 2200	4104	msedge.exe	103
PID 4104 wrote to memory of 2200	4104	msedge.exe	103
PID 4104 wrote to memory of 2396	4104	msedge.exe	223
PID 4104 wrote to memory of 2396	4104	msedge.exe	223
PID 4104 wrote to memory of 2396	4104	msedge.exe	223
PID 4104 wrote to memory of 812	4104	msedge.exe	105
PID 4104 wrote to memory of 812	4104	msedge.exe	105
PID 4104 wrote to memory of 812	4104	msedge.exe	105

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5368	attrib.exe
2580	attrib.exe
6448	attrib.exe
6752	attrib.exe
6788	attrib.exe
6744	attrib.exe
5752	attrib.exe
2392	attrib.exe
5440	attrib.exe
5680	attrib.exe
7048	attrib.exe
8152	attrib.exe
5888	attrib.exe
4128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
"C:\Users\Admin\AppData\Local\Temp\8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe
  "C:\Users\Admin\AppData\Local\Temp\8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe"
      4⤵
      Views/modifies file attributes
      PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x358,0x7ffbd95cc188,0x7ffbd95cc194,0x7ffbd95cc1a0
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,4805462265917409851,5255194465637035338,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
      4⤵
      System Time Discovery
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,3644497417163431764,3530424954151306295,262144 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,18378434872702188478,10123305955362953351,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:8
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,15732026230242909789,3052286676609152982,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12258708567874484382,11919672916833454724,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,4088785980675681318,13622422216695818438,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4348,i,139340272055181925,11639944293187750277,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14326767980889852675,17347789576549656482,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4848,i,14901373301463059215,3101859526259505810,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5008,i,5315393090376608118,17416098152220205822,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5136,i,1222886712484808750,11556287599753402229,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6686356932635487967,2475593889684917195,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5920,i,6877465132542533492,15507056847478079856,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6100,i,13903696073173849627,8221057182725269976,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6276,i,4510099965262230022,17863773432584635016,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,6058654683463518381,10210033265609124459,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,3690453412288210553,4577789146728196041,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,6169276134686930517,9827645891010385548,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,3690453412288210553,4577789146728196041,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6892,i,7464784028617886981,310100076130464716,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7480,i,3036355630111224289,17436982976501157694,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7288,i,7235993396690461321,15304111985539741516,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7788,i,11058848415666015863,2376027549418070936,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7812,i,2183753676144872582,9013268341477534329,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8144,i,2015505961350786909,12624168447247247619,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8268,i,11422474453188935300,4836066759291017080,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8252 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7536,i,11621750440438044216,887921026127645095,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8012,i,8884697404253011376,14001417419352690369,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8508,i,14205182419648745352,452391315758412492,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8560,i,16094896221069899716,3724228393271659929,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8516,i,6696901640772719773,8279265663024050762,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:1
      4⤵
      PID:6792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8752,i,15571219699699751351,4539236864083419291,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8776,i,16014317486149201485,2619989876946222571,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:6776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8808,i,922028475821310113,12677899167600526154,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3396,i,353215226143093694,9431290462738353491,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=9936 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9164,i,15983802227294793248,17471735645099513855,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=9904 /prefetch:1
      4⤵
      PID:6728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9184,i,11640482473417576375,17357137988402705993,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=9928 /prefetch:1
      4⤵
      PID:6756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9204,i,15742163819663520404,15139283824908397836,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=9992 /prefetch:1
      4⤵
      PID:6644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4592,i,6888812548685848239,1642532945914245368,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4368,i,8170854402536656066,16111066934863637641,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=4572,i,18001503788489407426,4300453739243618709,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
      4⤵
      PID:6740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4556,i,16211849002057102018,2008714390729200238,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:1
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9264,i,17975190451656979299,6187835638488697332,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9288,i,14441792266261919689,15594388678331916890,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9328,i,5930836451204717532,10904183289892407171,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9368,i,12972350795102121396,15970248278843010573,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:1
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9396,i,12426178593409610712,16464910782736627303,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9436,i,3042426440401379493,14136969445363909318,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      PID:7020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9472,i,4590802719887542183,9293523145028173309,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9568,i,13946559276886570083,5784681313204057173,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9600,i,11062281016771884815,18282569056969689956,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9408,i,4274065737422370938,9180823502260903739,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
      4⤵
      PID:6452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9616,i,18386485205513818035,18077296653699517886,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:1
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9496,i,4503486508001551543,3500387491955210711,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9256,i,13665703841420483131,17521060708213786901,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:1
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9712,i,16603645979463666032,16789619443746086669,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11524 /prefetch:1
      4⤵
      PID:8984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9800,i,7006939631475802202,9813482619739947169,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11560 /prefetch:1
      4⤵
      PID:8992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9844,i,15991803259008692613,5625320585296075996,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:1
      4⤵
      PID:9000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9872,i,7753593602349770784,12439181773386108576,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11632 /prefetch:1
      4⤵
      PID:9008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9912,i,710625202611708783,1499126089563873570,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11668 /prefetch:1
      4⤵
      PID:9016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9124,i,3516999116987148476,4964124280700896353,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11704 /prefetch:1
      4⤵
      PID:9024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=10164,i,1661516442660777608,16906842317139458961,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11740 /prefetch:1
      4⤵
      PID:9032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=10172,i,12810867080215765365,8602130961454431745,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11776 /prefetch:1
      4⤵
      PID:9040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=10188,i,6743777085037252575,1338406662243195457,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11812 /prefetch:1
      4⤵
      PID:9048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=10212,i,4447096596682623325,5357651882226517628,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11848 /prefetch:1
      4⤵
      PID:9056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=10224,i,13596967055165220911,8870996402115604590,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11884 /prefetch:1
      4⤵
      PID:9064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=9392,i,8227036433756283525,1519832881646292078,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11920 /prefetch:1
      4⤵
      PID:9072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8980,i,10066703320766351416,4781221361530423933,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11956 /prefetch:1
      4⤵
      PID:9080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=7448,i,1413380310936594477,18338498576575503190,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=11992 /prefetch:1
      4⤵
      PID:9088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9032,i,16973976648023188898,6943947373662639497,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12028 /prefetch:1
      4⤵
      PID:9096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9128,i,7861914102395649087,16257747194079953150,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:1
      4⤵
      PID:9104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=7616,i,6170480536309037264,609256420994347022,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12100 /prefetch:1
      4⤵
      PID:9112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=7592,i,16936308203119498601,2835097660996727225,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12136 /prefetch:1
      4⤵
      PID:9120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=5780,i,5220556611534408059,13841367917962919571,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12172 /prefetch:1
      4⤵
      PID:9128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=5876,i,2128377451153902858,6307207559480792942,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=12208 /prefetch:1
      4⤵
      PID:9136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10396,i,8691332909342390436,18361930673250818081,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14580 /prefetch:1
      4⤵
      PID:9144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=10368,i,16718861551254352791,15678835269427381954,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14604 /prefetch:1
      4⤵
      PID:9152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=10420,i,6664042081720060536,17849722913752231420,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14640 /prefetch:1
      4⤵
      PID:9160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=10452,i,2033295801008577214,16615227480684391419,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14676 /prefetch:1
      4⤵
      PID:9168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=10484,i,3870581994592991730,5505969406066603286,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14712 /prefetch:1
      4⤵
      PID:9176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10512,i,214738535365941084,5574105066560342417,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14748 /prefetch:1
      4⤵
      PID:9184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=10552,i,1340618615271616435,11089254988736037897,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14784 /prefetch:1
      4⤵
      PID:9192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=10564,i,16334970003741129104,393261198767363809,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14820 /prefetch:1
      4⤵
      PID:9200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=10568,i,11239439084961947119,6522020935973790942,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14856 /prefetch:1
      4⤵
      PID:9208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10648,i,5258932819690152644,17754943201007238750,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14892 /prefetch:8
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10652,i,5562182974749288388,4265811379958912121,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14884 /prefetch:8
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,10397590828632546568,17216926673907021192,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14912 /prefetch:8
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=10664,i,14981745619247984748,6503516092870596238,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14924 /prefetch:1
      4⤵
      PID:7200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=10692,i,8976052959270001267,17141506333112100325,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14936 /prefetch:1
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=10732,i,5115650193769446351,16537716306881880593,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14964 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=10724,i,17920630612358485824,11949354309067006908,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14984 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10632,i,1850499204794592839,15424074499914589139,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14952 /prefetch:1
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=10756,i,2469028343998818884,511710510384021708,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15004 /prefetch:1
      4⤵
      PID:8288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --metrics-shmem-handle=10780,i,14129014145574109183,18082174645204726198,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15024 /prefetch:1
      4⤵
      PID:7636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=10804,i,14420201134701511284,10566165538658675867,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15044 /prefetch:1
      4⤵
      PID:7692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --metrics-shmem-handle=10828,i,1946339710752472223,3973660323968586118,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15064 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=10836,i,11409054466945723685,5851805463929933440,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15084 /prefetch:1
      4⤵
      PID:7716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=5648,i,17279277919388145510,17763518212249462025,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15104 /prefetch:1
      4⤵
      PID:8340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11128,i,2275044801578072181,6660474788160758922,524288 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15124 /prefetch:8
      4⤵
      PID:8376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --metrics-shmem-handle=11108,i,18310469515752241596,15715861483673022271,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=14956 /prefetch:1
      4⤵
      PID:8372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --always-read-main-dll --metrics-shmem-handle=11084,i,5282214201427667409,10782729111022863826,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15172 /prefetch:1
      4⤵
      PID:8424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=11036,i,4322709196520723912,6648250711461028760,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15204 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=11060,i,778258874663276109,13331975027249347838,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15192 /prefetch:1
      4⤵
      PID:8472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --always-read-main-dll --metrics-shmem-handle=10976,i,4060302013796667097,13784268245271141251,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15224 /prefetch:1
      4⤵
      PID:8292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --metrics-shmem-handle=10968,i,17182976081747243869,12319313121078158150,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=15244 /prefetch:1
      4⤵
      PID:8300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --metrics-shmem-handle=19860,i,17462464701912076064,705617206936133171,2097152 --field-trial-handle=2332,i,8228681515681285682,10045393560565117244,262144 --variations-seed-version --mojo-platform-channel-handle=20776 /prefetch:1
      4⤵
      PID:8316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe
1⤵
PID:4936
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe
  2⤵
  PID:4064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2364
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe"
      4⤵
      Views/modifies file attributes
      PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5652

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe
1⤵
PID:2132
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zx8w1na7\8fym5k5u.exe
  2⤵
  PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe"
      4⤵
      Views/modifies file attributes
      PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5500

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe
1⤵
PID:6120
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19xa0gxz\j1ci2390.exe
  2⤵
  PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5472
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe"
      4⤵
      Views/modifies file attributes
      PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5328

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe
1⤵
PID:4448
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4r0nhmql\o04ozi0j.exe
  2⤵
  PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5152
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe"
      4⤵
      Views/modifies file attributes
      PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5248

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe
1⤵
PID:5568
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\eybzb28o\9wdjfpq4.exe
  2⤵
  PID:3408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2716
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe"
      4⤵
      Views/modifies file attributes
      PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5992

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe
1⤵
PID:6200
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tm48cu6x\5xeju9z8.exe
  2⤵
  PID:6328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6380
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe"
      4⤵
      Views/modifies file attributes
      PID:6448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6752

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe
1⤵
PID:6888
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w17th593\m1nnw7j5.exe
  2⤵
  PID:6960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7004
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe"
      4⤵
      Views/modifies file attributes
      PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6624

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe
1⤵
PID:6692
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sk9smhrl\s5m93wfx.exe
  2⤵
  PID:6704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6732
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe"
      4⤵
      Views/modifies file attributes
      PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe
1⤵
PID:6564
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hr7hctwd\lu69kj6n.exe
  2⤵
  PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2396
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe"
      4⤵
      Views/modifies file attributes
      PID:6788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6664

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe
1⤵
PID:1696
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dlesfm26\37m3fpyy.exe
  2⤵
  PID:6212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe"
      4⤵
      Views/modifies file attributes
      PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7332

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe
1⤵
PID:6772
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cuzpudpo\owcxi764.exe
  2⤵
  PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6412
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe"
      4⤵
      Views/modifies file attributes
      PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8068

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe
1⤵
PID:7612
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xeqsupuw\geefx3ua.exe
  2⤵
  PID:7816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe"
      4⤵
      Views/modifies file attributes
      PID:8152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7620

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe
1⤵
PID:7952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i5pyiqh9\06rmw2rs.exe
  2⤵
  PID:8088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7496
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe"
      4⤵
      Views/modifies file attributes
      PID:5888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8556

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe
1⤵
PID:8972
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x91xqvjg\1ntjxm3a.exe
  2⤵
  PID:10284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 298KB
SHA256 9f16cfc50d767313590552d6130a27fdf473f963abba1aee5891ca7e2a60e224
MD5 f52a30fe51f89d0fd8465bb0b35bc577
SHA1 8f0b205e69170a91cb3a2fc144a9542da356ec46
SHA512 f295923d639231f6023b8fea955717dd160020e9095ab203d0496f93f2514e356afc165fa548beb2b0c12c0aa1f47baaa1d45826a9ce8a4fe32c4d755e9290c2
SSDEEP 6144:q8va6/yQTcefZMYxVoGfWd+sJYt9dQm4r3q+Rp3V2y3JsbHFVagnkblIn71:DmQfxMYxVo6y+s+tora+33Ey5EagkRIB
TLSH
T1415423FCAC2678FDB7F0B2A18DAA1DA3F6DD340481EE6B741A584C063507EC5942267D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 29KB
SHA256 397688e842c93065d8885e278d65f8dbecea80fa9a3b7d7234dc1c13cfd15c5b
MD5 900e1a4e27371a6b70ce3a706a411717
SHA1 13bcdd780e9580e2cd74cdceee8b27f6d0184007
SHA512 edcca2f2975089b06c2345d38611caf00d43e8ecd6eace44b2d1f68c40e15514dcfa482adf4745b0fca77718e5055ee38307bedeb77337b893ead762a14fec94
SSDEEP 384:hu2NXjOrsEQgVsc1gp06MWK7Gh4nbIjLlhF89MOnefMc9V0DAbDe9fNniTRUYjv1:FNX61gbMWK44bIjRGJe0c4DNniFf
TLSH
T143D2E1644624F3774D2B5A3C1EA1527AF942A3F843721B24EB5A74733C287CE422C8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 37KB
SHA256 fef2ac78ad210be970828f9a019803e308d9a6c7ac66fc6a57bf1e16b359a186
MD5 a2c471c4a2e718cfc49b11bf8664b16c
SHA1 d7ceec36e2045d7f5a69724920ccedd1802d3721
SHA512 57e338060752cdfdabdad27e2d1d3fe61c71f9d0766c953f72b4dcf9a6701bd92eacc90a6f9d08900ed52ac3d54f5d8b909a950a6c9213d9ee27efa1343d51d9
SSDEEP 768:tt+F7nWSjcs0VQFUCV9vmSkTsFKlmaMTTBKrc7z4IJpuqOZR7oO4kKo++XMBb:tt2bWhQnXmS4lmaMTlP4UO/oLoS
TLSH
T13803F1CDD23BE07B884B1CA652E1D4CDBE9228A9637C35B04DDE5192255E00DBAC18AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 43KB
SHA256 e90e1fc1c623568fde6dcc82159e2909b921a944a06a070462657869fdf741ee
MD5 17ef6cf1c2a72a5fe8fed0ce41fd07d5
SHA1 e5ba686e1567afc2e40c1b74f3ae58ca126e05fa
SHA512 26e9c3ab4d9babe4a300f6a5681349f94f3f2623436b6abfba17f3b7367e207ed26034d3a1149dcc5291f7f44ae269d7bcb11f1560234324bc685ffc5e20dcec
SSDEEP 768:MBKXzmV+q+SiYqVZExVhR1kM6XHgteD7zDmWnMGUe/Wv+VxifSKy6:MB6zmV+xbzZohR1BoAI3JnLUf+VxCy6
TLSH
T1BD1302C18160CA9CDF7B8B627964F3F23DFD2119E8C89B1551D1CED8A836917432A3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 66KB
SHA256 e888dd5caa1e53a88937da070b6ebcbe9423ca5e0cc12faf2d0fde83018db962
MD5 c066ed1ffc88b8724f386f763dbf80d1
SHA1 b2af6f6a0c499a1f389dc423ca8a654c29992221
SHA512 f640f5813adb0a8bc1eb8423b21159676cd424a28bc674dcdacf3cf3786fc7a5ec777cd65f3b6a4e6cc372d84cd49811c98f8a0778189e93b466cc886b32d681
SSDEEP 1536:/qs1oJn9gWhvER6T7X4+JO2DRHeLf1g22Je+pM:BoJ9VNERqk+vYm1RM
TLSH
T1876302AA0D753668D64F56EC9D6430C1F0D6A83A487CF082971E55C24F6BBE50F831B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 75KB
SHA256 3b4b2fc56d46b5c95f4d2a790b21221bf4d3cc3e6c14ce66a2e2c249da27ff26
MD5 84c6c466a288b666c9e37601b684e27b
SHA1 5671728eddc4cbbe6e6847e0910a7b1fa08e3d93
SHA512 e8d093ed618e1a909794d9c3c117accf2bde6729607a677c0744dad6a0a8a35b8e60cd45bbbc5fdf8b6e07882f30908364113637b9de105a276b29142f693ca1
SSDEEP 1536:CrNnWXhhcu0kiKWMGWHO/B3VOPE5tZpUF3zNJ5MHHwbYoXLjSh9cEPI4nB:CrNWxh70LKWJBFJZpszNJ+mHj29DnB
TLSH
T1707302DBB407EF1FECFD5BD64A2A0D838B1F5B222681444B30BD49F6E379E942448295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 100KB
SHA256 4b5a2b1544b5e2446988ddda539f46da08144f0b93b3da97a332f635757bb88b
MD5 e13260961fd7fd5d5b11d7335b9d39e1
SHA1 c419499eabb46f250ab93327f87be1512c357000
SHA512 abfd4b4f0cb9123c70562296404a2e1d0b9f157260951671f69cd99e3664c72b848d6d98273a6531fabe8d29c4d6a168cf3c839dc700543a89273d066653ea62
SSDEEP 3072:NAKIzSBQukQpZrCAiapap+IK9hWiCeC9v4Z1vCYWfjtx:uDSBQuZnCMpapjnijCyqZrtx
TLSH
T14FA3129503CDA67A0216808679AAD37CB77E12C8DC29C6F5D07FC2A154C2ADBC5BD3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 105KB
SHA256 f6b0db8711c99c4681767c0f8ca12e2490facb4d9495696f218ad6ffa8eac716
MD5 f60246dd14f64d60785b7599ab139f5f
SHA1 8fec576ad236b0c760280849a101ab8435d27051
SHA512 921c15c91ee48233c8883ff40c6625cfa5b9235f12a36af190c48bc1cd876772e9fbe4b297895cbfad0cb23ac4e786804303065b7e176fbe4b67e49ab80ce090
SSDEEP 3072:QmIsz70QFPTlnJdUPXO2klznJEJBtTdOIAnJr2odblv7nx:cszZPTJYO2KABtTwHJjdpvDx
TLSH
T16BB30218BE6055A2C7A32349086DF49578E732B8C625D9E6FB409F0DCC60DBDA0A45FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 219KB
SHA256 f47090ae8b9141ef56703bdb58c6e944f4acbe890b8a71c70f9a65e1ed777128
MD5 2c7fdcc287cc74818ef49e715a045805
SHA1 a2f4993df4450593a2a7b821c0cd4230feff031b
SHA512 bee743fc515696d6966fe60a9e930520d66ac80434e44732fcc1e2a78996d766aee8c0c774717fa7cf329a60f41f8593896a8277e55efe7fb828d23ce556b68a
SSDEEP 6144:PoRBZFCrEMdEQcBplrkiyv1wTm2yOZWnwav6uT7gB:P8bYrEMdDYgieSXLZWnw56gB
TLSH
T162242342990D69484BD803FAF5FF3C449C5B5A09982B20696FA24126FFECD4E43F97E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 327KB
SHA256 2b496869dfceab6a5a6fe61b45857269a118af469de8c2037fe32cefdf2db2ca
MD5 a15ff4fe5851d1986b0b5c5525e5d0d5
SHA1 e699add78aac377a1e7d6bb04788f1ddb94c4a4f
SHA512 87ebd83427e2de5e03b6f763c246b69308a06516ced716e510f570045f8e77924a06b1e6f8e0f0c123aa013d7dcfaeea2f98eabc16fc7104479974c29dd663ca
SSDEEP 6144:A7XlyRhUwslEWJt8k14UTidVyzk3xpsCQ/CymdPJJl6tyGscgyU:1UwsrB14tozkrsCOCRdXl6tscgyU
TLSH
T13E64235A43FFD31B7DF8B22AE024DD46370C526A7943E4139E69B37601E8FC9524CA0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 92KB
SHA256 28de974db68e420aff9574b5fcb8c0eb942e400906eccfa09605bcac1128d389
MD5 ebff0d081ad5aa3e029a3e8c3f2fdf09
SHA1 bdeadc3fb3ab2523c4ea7bcee5324a1e77acab82
SHA512 95dcbe00be14ddb1643f51405347a395b6f9ee5432374e354cc8537f9ac3e3b5d240586ddf203765e829192bbdb63f90a348be87c64f3dc2d2379c411fd26e05
SSDEEP 1536:1hE3fMb2qNofLd4Iaf7kc0ciAYQ854fCiJtWWWd0gJshDWLw7lLZaiy/YTXOqhBH:HMMb2QoOlfQDrAYX54fC0WWq0cWn4pQ/
TLSH
T15793121489A54E6F0B78CA0637CC6903E2A147D0A13766370A27FCF215CDE74D927BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 19KB
SHA256 8924f44d76426a340b105cbdc5b93678c6b772e847b393f2568d94847c0d8d80
MD5 b68f6a53572803fc0845856e65ba6b11
SHA1 4b8ae79b4874c5aa89acacf8667e94fce89dec65
SHA512 9d194cba9e8225a66a520b614be53ab6e7020fd4a6ca7ceadd5d4f5b2a98ae8aa52af45a497633e2a59e57ca541a5f030d46db60f43cbe23e63bdc302e68e20e
SSDEEP 48:Xfq3OqXAzh4jaJV9HxG8LaSmO6IgbExw1Xw8JomVn+jwn7:CcwaJViU6IgbEy1AO+jwn7
TLSH
T15692245132430308F45D06B0C647B15A7BED7C832C675E67E9AB3A4E6FF825890275E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

282bd5c2a10676c1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\282bd5c2a10676c1_0
Size 270B
SHA256 e8d83bd699062fbef086a0c7f59116db4de5b8061eb4b8f7f1edee70bcf0fb47
MD5 ff984ae97ba95d3be349e04ff820e403
SHA1 0e67623d47c420fbbe9c74220c33df589881329c
SHA512 7f550368e8340cd1d81c048927087ba80b1e619f18d47827269bc4c6979ccc90b4a14d965a63cbeb577f7efedf1d28bf0bda1a98afd9529b45b7be7bfd526b04
TLSH
T109D02B6F110CD1A1DA38CDF0DFBFA52A916380044AFD80A28100A6F23D06A34FD065A1
MD5 SHA1 SHA512 TLSH

Submit Download

5ce22d0a0e56606c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5ce22d0a0e56606c_0
Size 602B
SHA256 93681584cf1aba018da0cbbd226a4ef429059cc68681e8ed6f12dfcac2d3ab47
MD5 a7f21802d6cbbc79904cee9286a784bf
SHA1 810068ebb47cb77b0a9a8a99d402ff6492dd5ce0
SHA512 ac12195b058cc02acc2d302eb1b8fba16eaed27104133ced3828bae5993e3737ca7c78030798846980c418697891150b45a9a17f129c1aa14666705efdf1e426
TLSH
T1EAF0412BC0595C5EDE7E8FB08DC2E6514E33C2580C9E1AC6206A0599A12B8B17578CC5
MD5 SHA1 SHA512 TLSH

Submit Download

90c5cbb4cbb29f62_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90c5cbb4cbb29f62_0
Size 78KB
SHA256 d17d0a8d4957d3c5abbedea3815af1db142abe745be398c5ab191e7b5b4206db
MD5 0beb51e32068f211804a48c16c7366f9
SHA1 3f7d187142f6e406a129e9244f72d1f6da5ffe34
SHA512 34ba517663bf3142e61277f1bdf77287ee4aaad579730452670c3431573f00044a0e64aa183511245ce5ae4cfb1e85e52769a0fe4386cbc8442a1c9d4ba7e616
SSDEEP 768:bxO4igSc24dFQ/wjfye4WuDf49OkbzNV2McPJv3AFjqeHtcpKNgBU7+BOSUF:bxOxzuFnRuDtklLcPFAFjqeHGBBUaU
TLSH
T10B73E8455B50A996CD6A73F411B78527A33181082EC7E72722F4F3363C4A2E16EDBE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c41e7407389b628a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c41e7407389b628a_0
Size 602B
SHA256 afc088de20f75ecf690bf81e79e2afeebcf689aa2519046cf04a6246cc6d91d0
MD5 49213d478c3dcb3046ed6f42d24e1cbd
SHA1 4410597d27d608858cf682cc9bf331be186e45b0
SHA512 98e66e58a5da31672486144b93c7bc69ba7f290beef0405233152a35d7b05089d6c196da6a8767ccce8f38d34d480480842750062f076a9efe7e91fbf796d996
TLSH
T129F041A3810CFD25F43F9EF0CAEE6D5692A2E2D7966C1561D07190B3328A261317D0C0
MD5 SHA1 SHA512 TLSH

Submit Download

eeac190a2ce11f0d_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eeac190a2ce11f0d_0
Size 24KB
SHA256 bb5838b0d2e2c36f30183acad042d11b7b0a443b94040a78522233bc6e72612e
MD5 c82facfc03f6d03236244164ff87662a
SHA1 ccda554df398b6525420cff1228881f5e0267acb
SHA512 4932ec59d24d18a20a2e2c18f2ef75b13ae0ba368f73e93b5155ba6c80d95d876991c4abccc75c431c632ac6a6ec9a913a3f0aab47269e9d3681a71a7b34728c
SSDEEP 384:LFORpKLKYPkaHRIo/OpCFLoEG9GAs13qxua7NoD1bCH2LZi2UVq0V/HyW7si:4GRiFCFkEKzsMckopGHOy9ki
TLSH
T191B21A0527549A8ACE6A33F804776957BB3180002ECEFB1750D2E7346C4C2F56E6FD9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6fca03e5e8edfac_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f6fca03e5e8edfac_0
Size 289KB
SHA256 cd565a644825cc9330c4efb280cdc0707932295bef3eec569c9b1c66d6798a62
MD5 af952847f36c905aae8786a46f34880d
SHA1 82471b7264a279adca894ecbcf8cfc2927e9d4aa
SHA512 2dbee37ea73696280e7b151b3cff2649d1291c6ef3fdf1ab311fa2ef5ee94a9971cf6b7b6b2a01909709e09eba9c11ddfb84e7f6c464c143f9e63bb6428cc4bc
SSDEEP 3072:itVuqpXYuE9ZURDvb8HgbPwJHa2APGEF1PQ527XDc/Jk79+Oif2p:iyM1RDbFb8Ha2AOEF1Y5mUJugOif2p
TLSH
T16754B5591B90EE25CE3663F502A2C953A73591443FC7A31371E4A33A3C5A2E25F5A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 cc19b59adcdef79e779fea188c7bbb2af816e0f7aa46f1b2232bed987120faba
MD5 39cf1567daa14c5289cd6552bb304496
SHA1 e31787fe77b295a2444ba55c3b987984f3f0ecc2
SHA512 8b7c1e52efc7434cac75c59980626928315bbdd5759073e420be569fdbfc5cbe2beed256390eb398ee2d8073a2c8302e1921f2fde34cd306a7a46367b8785b1e
SSDEEP 192:sxZmRij6/fMsA8eMEdp5jYFq/W6+WNcYfzVmxYffYBxxnIl2+uvuIgyJ:sxZmQ6/fMsA8KOOb70af4f9vGO
TLSH
T12B32C812AE3869774DDBD21AFA25BB13E6F6402291D10F48E7FC961C14E66DD220B84B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a25445590757e50efb202e4299961c7727e3ae042a514eb63422a7c40c3231f8
MD5 f2b8a30219da5070f7d2fc3d774cba82
SHA1 90794ff7d744dade99db3650749e4b075d92f333
SHA512 bd62d7eab200f2d05f2a5f197de27cb4b8ad71e8dd16845be7ceea011759a102eb224b1d1b49c1636b9489e05f1094e81f194429dca4eb8e46b4b7fee60ccb96
SSDEEP 192:sxZmRij6/fMsUXSMIdp5lXk1Fq/W6+WNcYfzVmxYffYBxxnIWm2+uvuIg5lXJ:sxZmQ6/fMsUXe/AOb70af4z9vGh
TLSH
T12D32C716AE38AD774DDAD21AFA54BB13E6F6403291D10E48E7FC961C14E76DD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 55ae6797543bc59b1d267459f08eaceaff23233bbeab103470521777cb393554
MD5 116f83dd79d845f8383d548dce70e4cd
SHA1 d6a25ae3229edf53b3748bd23ea29cccc733cb70
SHA512 136507df3e62c8f0ccd68fc83231170815aaff12ff824a60e21eaa7c61e66fbf360d8e4f11fed0f981dbbaeaf32b979efdf0351ac85d6830111be3753def78b3
SSDEEP 192:sxZmRij6/fMsUXYMIdp5MEfyFq/W6+WNcYfzjY3SJYffYBxxnIFn2+uvuIg5lRJ:sxZmQ6/fMsUXQhyOb7Pyf4B9vGz
TLSH
T1D842C716AE38A97B4DDAD21AFA14BF13E6F5402291D00F44A7FC861C15E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7d89f68b60f8a86eff78a2fbef13a6f0e6d3c26fec5e5e168e5fde8972996c5
MD5 2d4cfa63144bb22dd6dbd64db53e6724
SHA1 93c89b0e064a458be5ad8986288413850eca40b6
SHA512 4db585ff88ea64a5d00db2544ef78134698b84c988815628a0ec210fe0b8b1b7ccc997fbee7a63d5d2e433ce8a785fe15040c331e8b565e5ee25e5dcd8018676
SSDEEP 192:sxZmRij6/fMsU8NMEdp5vSkFFq/W6+WNcYfzVmxYffYBxxnIAm2+uvuIg5lXJ:sxZmQ6/fMsU8RZDOb70af419vGh
TLSH
T12032D816AE38A9774DDAD21AFA54FB13E6F6402191D00F48E7FC961C14E76DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 74ab54fb949aa44fb421750077395794f16209ad444e82bc8818052a8e943e41
MD5 a9591ff422453fe95791577e885b4991
SHA1 dd7d1bec943844221ac975fdfc4a306a1f4933fd
SHA512 e5f600a8ce0a64928fb5178fbb2f7ee1f51d821cf529be4bf9cb4d1549cd7fad3772c6cb7d1bf9240bb763a558a45928916ae38dd9dcdb9e3de098413b3b4cc9
SSDEEP 768:H9yvIAwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtFLlwmW7wrohJpmLi:H9yvIAwWvu+Q+u1ja6FLeR7bhJh
TLSH
T18DC2E82B640CCB7E5F801A9DDD5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 2e3d2f18564316b0172d8edc00f1be77da07fd7dc96f8574e9b8c2a66ce6bc71
MD5 959812081542fe3e2910fa649617253c
SHA1 9abcaf98b5d49573d37e6d973bba157a569e223e
SHA512 81903b72e31df52b8b9bb10d0a1c91113fd1c8a9b33a653045a1815c7e64c2dc1f71352bd66a519a561bfd284571702f2f7cf43462293633be94c8439ba5e5e0
TLSH
T1CF2141C0E7EA10D5BECABA41C10A550391A1BE6B120D5C327B6E91F68FC88170E2E921
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 262bbcbb4c3932a76c0c98e88f8a4c8f3a10da22eacd0d5f776acd76d881b680
MD5 27ee785d2a7380c6f77d3fb31aa58a8d
SHA1 921688e3f3f9ea07e31ae8c617b7adac94a47980
SHA512 532e33eb70474918becd375828cb609ab75e415f9d9916e11fc48078652e786a242fa3e66f97a3fea95916f4aa3992986c9d0576c45429d204bce697d4d0c9a4
SSDEEP 384:nCZcI9sN0UuvwBzitDo1e+CeODejhC2KuXdptVPbusxuCey:w9qKEk2OijhC2NX3rbv
TLSH
T10C827D70AC756C7659FAA152F94B37179EFC90B7A6856E80E4D89F0D00D7688230F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c80ec8ff9345c63472684a776ffd44d9548748ddaa59f4f738049ca637d84d1
MD5 19468f62e24a83036b51e9c9dfc14fdc
SHA1 2356c168d56400fd34affab2018adf0457f0b5a0
SHA512 3ee8e7ff7fca4de0205519d889e0b87ee48185fc47452f1e1ac7f98ed7a58f8dd6e0e7a00d0c522b429f422934eb61075604119eb3b6b339860474f4f1217d49
SSDEEP 192:JONj6v+YLNQmiUyQFZh+CGLOD9oqusyZU6:JONj6vz/nZh+CeODeMGU6
TLSH
T10F02E935BD382C7B9FF2AE45F98736179FA81177E5552F80D9E82B0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d475ccd4f8d6ff5f3056afc0d58bdc2954e345aef65b7f6dccb04a4a7def69d1
MD5 6da50c5dbe7170d956f6fde4c5b0204f
SHA1 87687a6d79a11578746ab229542e06e710c7d989
SHA512 5ade2f91c03f36a121491a325ac894503da9aa2f258ca47de127ad0053d0e098abc0944c5b7cc3380c5b03b32997bcc331e81f672d1ae05a3b91339579888e75
SSDEEP 192:uuZ0gsN0UyQBCzPoB+YLeV3QmiU1OcE0e+CGLOD9ojh2JixqbrL6HaMQ:nugsN0UyvwBziD7Xe+CeODejhv2L9N
TLSH
T1ED423975F8399C369AE69156F54B37539EB850B799862F40E5C8AF0C01CB78C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7dcff476166adad6347902e30a92d4fc5442ed247c36522b1c4897bda8a0bae6
MD5 5151eb7403c7144525f6dd27bf5be0a9
SHA1 0914efc2ae7f5a04fc65fa4b54564b6051f2d6c0
SHA512 889f02d425cd5614701cd9ffa3a5339cecff500d38f8f115db4388749140c09439ba7dd8b6564980f7b0e0070792bb93adf420d2f470b13bb606d939bd701094
SSDEEP 192:uuZ5sN0UgQBCzPoB+YLeV1QmiU1bchNe+CGLOD9ojh2JixqbrL6HaMQ:nvsN0UgvwBziZ6He+CeODejhv2L9N
TLSH
T12A423975F8399C369AF69156F94A36539EB850B798862F80E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d5b38ebf5d9c9fbe460376f9b39752f0a323e0f73287710ba7e53377f999daab
MD5 f6dd029bb6ab4a83c450224d90642eff
SHA1 43228cf57318a0ea763ed7979f6b2563f819f0f8
SHA512 2ca06473d0d4a7899dadf04adfe5834b150fe7858baf426af1b5b55f149833e6de92689e12eebdb3ee2de1ebbb75f72379587f728a8f82088e0297577e8e18f7
SSDEEP 192:uuZQsN0UgQBCzPoB+YLeVmQmiU1mdcu0e+CGLOD9ojh2JixqbrL6HaMQ:nesN0UgvwBzi0HLe+CeODejhv2L9N
TLSH
T112423A75F8399C369AF69156F98B37539EB850B798862F40E5D8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ded26acb1c3ea2bd672e0b111e62093ddcb83bf61d0a9f53a0d2df631f474b3b
MD5 0772c813723ff01a8cded0ffe74522a1
SHA1 d3f5e1d40591a10aac2a498a94b71a8a62d4576d
SHA512 c779ed0a93800df16f909fec6853e0f043e66d8436ca1316fef6e4a1ee2d8cb1f1b55406d211da29e2328dee8a6ec9b48d93323b6d5245ec926aa9ac499853fd
SSDEEP 192:uuZQsN0UgQBCzPoB+YLeVwQmiU1macNHe+CGLOD9ojh2JixqbrL6HaMQ:nesN0UgvwBziuwte+CeODejhv2L9N
TLSH
T1E6423A75F8399C369AF69156F58B37539EB850B798862F80E5D8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f26125d7d7fbf6327a0214f10531a67ded4f3c4f8bb14f71c37f6e9aff4591c1
MD5 7eb91454af8d3a80281d95cc58751803
SHA1 ace2f176f01ca45ac74eb1026315cd73a4c3d7df
SHA512 c05e5fd98c5aaac80dcda30f26ab06bc8dbea82a518fd73b3b2777518b73ac9322d1fb4cfcfbc4b57778c9413477f1a6ac0ede77b8a82e17433948adb988b4fd
SSDEEP 192:uuZxsN0UgQBCzPoB+YLeVTQmiU1mOc5re+CGLOD9ojh2JixqbrL6HaMQ:nzsN0UgvwBzi/01e+CeODejhv2L9N
TLSH
T107423A75F8795C369AF69156F54B37539EB850B798862F40E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 46e542fab57cddb3b304a4dc0a8e68d304d3fc6b898c07784e4ae60583d4f960
MD5 67c58614b05b321a31fdd570277d8be6
SHA1 34ba5de669bdc9f25d6b8dca29929d81095d2808
SHA512 67bbf03cec38a06e51c8c5faf8433d854b96e22d2baa8b9675d82febcc7e972411bd8f30b0c389de39d63e7eef4625623321520b43b4b15acf095f3eba210485
SSDEEP 192:uuZxsN0UgQBCzPoB+YLeVFQmiU1mbc8Oe+CGLOD9ojh2JixqbrL6HaMQ:nzsN0UgvwBzi5d3e+CeODejhv2L9N
TLSH
T1BF423A74F8399C369AF69156F94B37539EB850B798862F80E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 04e7d5cc4ee197cde2149bffe84f4db4da8354afb849af1a2592bc2fd5d3ca2e
MD5 4e2357e92a4c3de78f0c9c82c2681b3a
SHA1 c85879a7d47e15dc4acd9cd6c06c7f319c1e9e98
SHA512 b66fa4953b456c8d52fca058af608a7805252acbe0eed580afc1e0e3cc731717b4e512fcc622ac5702588df045f6d34d0d585af5b245fde96e5dd7011cc8b266
SSDEEP 192:uuZZsN0UgQBCzPoB+YLeVRQmiU1hc2ke+CGLOD9ojh2JixqbrL6HaMQ:nrsN0UgvwBzih0ze+CeODejhv2L9N
TLSH
T17A423A35F8395C329AF6A156F54A37539EB850B798862F40E5D8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f5a372fbf84a28d1cea4ecd4d4182ee566ce2d7b2972880d10cf01b7acc1db4b
MD5 13c159707494d5fff6ec402727d5cf71
SHA1 c5f1ea4292e32c6cb35cc7d6ef92589131e74408
SHA512 8ee542fd3fb05151e2035520f45493e76d8e912b6c6d8dd02299a193e8184d39d9c7669908563154e51cb69d8ec9e662a5cf1e6831365630aff30274aede8502
SSDEEP 192:uuZQsN0UXQBCzPoB+YLeVTQmiU1JcYue+CGLOD9ojh2JixqbrL6HaMQ:n6sN0UXvwBzibAfe+CeODejhv2L9N
TLSH
T186423935F8399C329AF69146F94B37539EB850B799862F84E4D8AF0C01CB78C230E816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 be7e4a45dd484a7fc55054d5b200eb7bdf20ae2ba54d42b15395ab8eae991127
MD5 4f3d8fb6f7bc932497ffbccd6a79a8bd
SHA1 bff990c63b40f60442d410f36e57b2a705973985
SHA512 dd499b42d6cedcb4ab2f6e1d605e4d86953d527dd855dfc28da6203d01fefc4a925350dbc927a599fddb134091f63930db7dc692b02c086845cb89890d71ba0a
SSDEEP 192:uuZQsN0UXQBCzPoB+YLeVrQmiU1Wc3he+CGLOD9ojh2JixqbrL6HaMQ:n6sN0UXvwBzizXRe+CeODejhv2L9N
TLSH
T186423935F8399C369AE69146F94A37539EB850B799862F84E4C8AF0C01CB7CC230F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 6457dbb51093a9ee036118325301df502696fcdd50eb29866f54870f77a41eb8
MD5 e061870715c0437e1256b83d48ff17fb
SHA1 bdbd3951e0ceb791f570569b798a65b42f0195a7
SHA512 f9348b3bcdd79e3873a75e0119a9efebc142f20cf4172f5562975da6a37b1d5c9a90544e8821fe1aee081ba670921a0b1e63dcc375c4bbfcadb4a71767094b64
SSDEEP 384:nLsN0UXvwBziz7wMe+CeODejh02KuXdptVPbusxuu:LxgI2Oijh02NX3rbz
TLSH
T132624B70FC796C665EEAA546F54B37539EB850B7A9812F84E9C85F0C00DB78C230E81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 76e3cdca370b423b3c2510c8c85f648af2bdab7936eaa71a130f3e3a60b54ffa
MD5 936d1ed72f0b973d99640a21dbd8f753
SHA1 0f5f03befd742f626f721f064bb9b5eccc1538ac
SHA512 db1f623006caa111d3a53b7600d0ec98847c440a673bedd32be2b1321fe91af98c543ed6da6f52225772c5e92a85f561d7835d1027ea9e137b5ac88e8a4ed045
SSDEEP 384:nqZcIfsN0UXvwBziI6Le+CeODejh02KuXdptVPbusxuCey:IfxUa2Oijh02NX3rbv
TLSH
T187828D70AC796C765EFAA142F94B37179EBC50B7A6816F80E4D89F0D00D7698230F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7163aeacef304ee48178fed82770122f9fbdda1ac3e6535325559b9ad8c702f7
MD5 d1c9e1201fe0663e2717836602c9e066
SHA1 8d5923d02cf08d721ccc4170c7e19deff7600380
SHA512 411fa107ac75ae67698b3120d125916510a7160dc6a0837f70ecdfbae337b561bed14921bf730bf41a79951640f1a8fd3f728e767341d1dd21d8998f8c2f2cbe
SSDEEP 384:nqZcIQsN0UXvwBziKJBe+CeODejh02KuXdptVPbusxuCey:IQxx42Oijh02NX3rbv
TLSH
T1D8827E70AC756C765DFAA142F94B37179EBC50B7A6816E80E4D89F0D00D7698230E81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a8536783a853910e14cbb2cb37d3a7e51548f1d0d562e29449072b21d0ea586e
MD5 ffdffc26586ab600d4ea76010213f255
SHA1 e2a859837d65f77e9025d37830e5bb746901f545
SHA512 d91b3066234a3f2a34a28a286121618e56cd46389eba4271a0e778f61c6f1b309938d6ebe9b9b25ba2411d7a58fb44ded33c474a0828ccbafefbc5e289e34ea6
SSDEEP 384:nqZcIYsN0UXvwBziIELe+CeODejhC2KuXdptVPbusxuCey:IYx2a2OijhC2NX3rbv
TLSH
T12E828D70AC756C7659FAA152F94B37179EFC90B3A5816F80E4D89F0D00D7698230E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c28105b9f33764ebb6348f94932bb6d77e07862f3872d471d5a247a4ecd8e239
MD5 32c31f0482322f32afa59484a2b05d8b
SHA1 2d063300b69b569c598c3a9f662597ab0fc2ab88
SHA512 c1ab300f0fc089edbb05cc52bf90ddd16693722b2c4aa7bb406b01e4cc1feea092fda469f9207fef16311f537218890707c9fd02900be584e2ee1069ab6edbde
SSDEEP 384:nqZcIdsN0UXvwBziSimve+CeODejhC2KuXdptVPbusxuCey:IdxNHW2OijhC2NX3rbv
TLSH
T1B8828E70AC756C7659FAA142F94B37179EFC50B7A5856E80E4D89F0D00D7688230F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d5dc6f6cb59b9cfbda16c1a07d6922eb1460d31c33843ea7c612bd641d196107
MD5 3bf2419d95cd556ba0cfd6185472d526
SHA1 a899bf64d8155dcdddc6e38c221dcc71a769304d
SHA512 56b4ac8d6bad99374af13f16162606679ea3492b13e0799035dd15599577fbcfb59a0650d5ba8aeca5b16ef9081339948b96b1ebad2f9e239bfec52d25a42d2c
SSDEEP 384:nqZcIKsN0UXvwBziVMLe+CeODejhC2KuXdptVPbusxuCey:IKxTa2OijhC2NX3rbv
TLSH
T1E6827D70AC756C765DFAA146F94B37179EFC90B7A6816F80E4D89F0D00D7698230F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35b2fcb007981427901933dce0cb2836302ab49d0084aa842a10d19c721e0903
MD5 6546ed518533c53eeca1dd18bd8800b6
SHA1 6c7d80c0250c421dfbf34cfd43e4bfb40beba209
SHA512 63b1e358cc9f4937046caf559fa47e4a1a3cc38dd21c30865b5b85f5d1a409b8f06f7c9b1b24da8ce620006477fde5fede9d918f6ca2d660ecef2f216737a13c
SSDEEP 192:JONW6v+YLcQmiUyIFFh+CGLOD9ojhjCHxqbrU6:JONW6vzIFFh+CeODejhw2U6
TLSH
T1AB123A31F9399C675EE6A545F48736539EA82177ED426F80E5D82F0C00DBB8C334E82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ea5f524689f0ec1af507abc98e385b0b6a41846935d62d876e05cfc042ac66be
MD5 6f2a18b0c47a658a89ab2a6299699b35
SHA1 983494a8a896774b8415c9940ac7e4213555fb14
SHA512 544e24068bb61c0cbbcf7ba0076944b6325af87e386efa004ca5097a77acb4cb9ad73119d112e098974ffa012457217916a32555fa3b2363ef86d154081396ef
SSDEEP 192:uuZ5sN0UgQBCzPoB+YLeVmQmiU1AcSae+CGLOD9ojh2JixqbrL6HaMQ:nvsN0UgvwBzi0h7e+CeODejhv2L9N
TLSH
T136423974F8399C369AF69156F94A36539EB850B798862F80E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 50e7996511b604b2889744653bc2c8cf42d52096d8b819909f315d9e26146f85
MD5 97ebb3a3279ce0897fabdd9eaa6649db
SHA1 4339a8ec1c9a39a1169e6b627f15c0d1f689191f
SHA512 4a3b6da94d5b6605d5dee9304c25522edbd3938107b1e86426a121195d5088a8536b634beeedd987019b97096b8f6baaf00a6f5d8bdcfbb7babe20154366d83d
SSDEEP 192:uuZ8sN0UgQBCzPoB+YLeVFQmiU1mukcWse+CGLOD9ojh2JixqbrL6HaMQ:nSsN0UgvwBzi5PnLe+CeODejhv2L9N
TLSH
T168423A75F8399C369AF69156F54B37539EB850B798862F40E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b202773f114d906525422f269c5c0d7125f787810ca50142144db800f0280687
MD5 93716aeb008f15d57eb951348a4b7b60
SHA1 b9603dce1550d4af26e8f3d261c235b70e08ad05
SHA512 ebe28da4a437818bdc530ca8ecac0b124a000a5f0a066acee7056bbce3ff1cf6c4aac7909c391fe939c436abe15599c6d0bbbed03d0a3e5c14d7c738e75230b7
SSDEEP 192:zrON0U6v+YLeVhQmiU12c2/e+CGLOD9ojhjCixqbrU9:zrON0U6vzihjue+CeODejhN2U9
TLSH
T13B221934BD39AC675EE6A555F58736939EA82077E8463F84E4D82F0C01D778C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a9917864b1a38fda676b0e427c0bfd42618a67595d469d503d4f54910c9b18ea
MD5 ce88d4658e93a82be43d084c3288086b
SHA1 0e37bfd1bfe118dab43851548e049f448d5829c7
SHA512 ec90579fe82d2733d40b207be3ef4c50ccf1cf537a7fe6ee6c2c1b660e562bb59677fc2cea6552cb78a9246cbe09fdd002302d9fb9cdb07eac4f6033d699ca4a
SSDEEP 192:uuZZsN0UgQBCzPoB+YLeVTQmiU1Rqcn9e+CGLOD9ojh2JixqbrL6HaMQ:nrsN0UgvwBzibd9e+CeODejhv2L9N
TLSH
T11A423A75F8395C329AF69156F54A36539EB850B798862F44E5D8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da49c82f5a8e58a285458d64e0a139461fb615bd15e89aabe54c82a92d15a1bc
MD5 603eb0235f365a8cca85fc2517cadfc8
SHA1 78d3398ef2442b6ab04af4aa9530e892a845cfa3
SHA512 d734910744f984b254395401086f01c9317d01316d1c887393438345d3cd4e06ed6c771d09d25ce0f0a7fc7d3199310cf1d19e7cce80fb3dc07fbfef924c284b
SSDEEP 192:uuZZsN0UXQBCzPoB+YLeVTQmiU1EcqAe+CGLOD9ojh2JixqbrL6HaMQ:nrsN0UXvwBzibJbe+CeODejhv2L9N
TLSH
T17A423935F8399C369AF69146F94A37539EB850B799862F84E5D8AF0C01DB7CC230E816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c5c9836b7d6b4f473ef4e09ef4da5379ea1585b5a926b16f12a9cf273d990d6
MD5 276eb412f8b6487b094f5df3250c8244
SHA1 e4518d548d6cadef6ca1ca93be9cb67a159ead96
SHA512 6317edc0855eef4671252d2884e4c470d320b5dc484155c63c139911dc854075f78fb6d39f255e9fdf0d7eb88f4cf16870a5d32234ff692ac03a26d896c9797a
SSDEEP 384:nqZcI5sN0UXvwBziIuhe+CeODejh02KuXdptVPbusxuCey:I5x0Y2Oijh02NX3rbv
TLSH
T16A828E70AC756C765DFAA142F94B37179EBC90B7A6816E80E4D89F0D00D7698230F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 64a594a2d6b52972a335d8e4a7992a2d360cb5dd616d7098fb2acdbff3fd9a4e
MD5 770c74ed83c76224c43d2c02f7b0d3b1
SHA1 5f0d812cf98eacb736adc41e181833c8f37cdcfe
SHA512 7244bf68800d10be673956b5b6e271cc0a6724c18c3e02c0e2b5faefc2a103308b5dd46f4ab45ec1417e25a7f0e2e62bd09a2df33ceeddf2c85c3db9626f177f
SSDEEP 384:nqZcIWsN0UXvwBziKFRe+CeODejh02KuXdptVPbusxuCey:IWxNI2Oijh02NX3rbv
TLSH
T109827E70AC756C765DFAA543F94B37179EBC50B7A6816E80E4D89F0D00D7698230E81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b21b49dbbaa9664b9908616f9f5c00a35eea42609be9dce9a24f0c0068f4e0ab
MD5 6f6b9ee5dd9a21abe3e6e204ec8ba974
SHA1 4192754ccdcea9ebede01f81b9f0f52f5ef834e1
SHA512 c8005eed73bfa4a906548ac71fb067be0087bf8f103ed76863691d2860c972e28e2fac91827545068ea8475c93202c61941386e05b15ee0bb9bb072541bfabac
SSDEEP 384:nUZcIQsN0UuvwBzimG3e+CeODejhC2KuXdptVPbusxuCey:SQqWu2OijhC2NX3rbv
TLSH
T1FF928E70AC796C7659FAA146F94B37179EFC5077A6856F80E4D89F0D00D7688230F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 14570c9cc969a2f0518a95064cc7c19f05f864641e8ab9bc6d6dc927d15c159d
MD5 4f1ababa21007c6efa396a14700b7693
SHA1 5276ca0ae3a8dac9f6487867447175f87776daec
SHA512 87fa0b5fcefc3fc3f16a368ceb3068bfdf53606c6c6c36a457af5acde96e98c03ada05cea6997d31daff783396a0e27a1c92a992b11a86374c7c8f4ba6467b5f
SSDEEP 192:zrON0U6v+YLeVhQmiU1Dczye+CGLOD9ojhjCixqbrU9:zrON0U6vzihCee+CeODejhN2U9
TLSH
T118222A34BD39AC675EE6A555F58736939EA82077E8463F84E4D82F0C01D778C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4662559c57b15cba7d98811aff3a43ddb56ebebf0300ce503adbd27f63f233b1
MD5 7505400a7c69c080f647cc2277cab78f
SHA1 bb643f5d27890273a3e7222e15ffaab33bcd4dcd
SHA512 b17f6be1121991ef20bd08b3fdefa29c342e50156ae8fbf66187038b843410da9df1d87218d12f94514957ee0f385d13b0f3e9c4548a0eda267da788304a0d7a
SSDEEP 384:nqZcIdsN0UXvwBzi6dVe+CeODejhC2KuXdptVPbusxuCey:Idx9E2OijhC2NX3rbv
TLSH
T17A827D70AC796C7659FAA142F94B37179EFC90B7A5856F80E4D89F0D00D7698230F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ce9f1bc4391595ec60b936a342d7e2bd11b807995f98f0f3b31e3f8de072d1fa
MD5 a970eef18f4e054a07b06c24e3c1c008
SHA1 d2f8ac5477656c31b40203884e2d4abc9ad2c410
SHA512 be9126bd0f1d17dd4c2b91ffb8b428fb3a7f7d8b9e4301039ab25b4181d86f24e824cadc2a7bec1da69b5faa87ef99b611a9f66e0f42b1b36092f58cf8dd6625
SSDEEP 192:zrON0U6v+YLeVhQmiU1Fc48Ue+CGLOD9ojhjCixqbrU9:zrON0U6vzihI4He+CeODejhN2U9
TLSH
T1E4222934B939AC675EE6A155F58736939EA82077E8463F84E4D82F0C00D778C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1707040e6a9c3cf1a197beecf57166ab474603111863a367595d7fd2391e8062
MD5 26f9f2dd920b1208c4e091f46f0cffb9
SHA1 1840eabd55df5555b845bbb1c7fcb17058e9a02b
SHA512 e4a3ef2a122fc15641b3bc14a72585f4790d8b5949319ff6de4b5036c274ed149a8409a982aaed1120693cebb77f54ae6171ed0ea1f7d170c7c7e6aeaf21f438
SSDEEP 192:zrON0U6v+YLeVhQmiU1QcIZe+CGLOD9ojhjCixqbrU9:zrON0U6vzihxie+CeODejhN2U9
TLSH
T18C222934BD39AC675EE6A155F58736939EA82077E8463F84E5D82F0C00D778C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac2b67be-b66f-45b5-a1b2-ca102285fd8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac2b67be-b66f-45b5-a1b2-ca102285fd8e.tmp
Size 12KB
SHA256 e09f14c495754ad084aba850a88f092852332cc3652be0699385b4c9e6d7eab2
MD5 b1c96d8c23482440ff1f8668e5474e68
SHA1 cb81076cb6fa1c4f96879ea110374ac5c4d2e624
SHA512 1417088816db59760fd366aad52f186b99785c97b60b7b01ee1b50895a712a57598237f1f4d376808f30a3b8ec955f78e300b186515c5143dd786764ebcb6f9d
SSDEEP 192:uuZ8sN0UgQBCzPoB+YLeVRQmiU1Hc1/e+CGLOD9ojh2JixqbrL6HaMQ:nSsN0UgvwBzihGNe+CeODejhv2L9N
TLSH
T150423A75F8395C369AF69156F54B37539EB850B798862F44E5C8AF0C01DB7CC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed7c965c-2a5c-42d8-b0db-50fa7aa4eda3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed7c965c-2a5c-42d8-b0db-50fa7aa4eda3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8fa6a79-4eef-46a2-907c-a3d3846cb718.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8fa6a79-4eef-46a2-907c-a3d3846cb718.tmp
Size 18KB
SHA256 49c7deb717e3ebbe9f15c291cbd5bcfa5cc6763f12eb49c7f7a08960c5ab7ee2
MD5 d590bf5d7cd99c5db33f50a754fb0ad7
SHA1 be9bf4a1792d9e2f4ead64e5ff59a0ce935c4dab
SHA512 f906ba4b48f9ac7993aa8811226a12d0ed5d0352c2f2712c7c8aa079b1e1c1378c25d07f3d24afe5876054736f1cf94eda70991c07affbb4d982ad0ade94e8a9
SSDEEP 384:nCZcI4sN0UuvwBzi1Xxe+CeODejhC2KuXdptVPbusxuCey:w4qgo2OijhC2NX3rbv
TLSH
T1CC828D70AC756C665DFAA152F94B37179EFC90B7A5856F80E4D89F0D00D7688230F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 94c0a55aa90bc29092da43e1591b5f678990869dd55dd72bc1cc75f92303c458
MD5 f8beb8729923bf604b7a136e80cc7e19
SHA1 4adbd71ee2f206abb7073103d5e39cd39e4c5a82
SHA512 66930d7621862fc9824ab0989854373feddd54f45b0591bb1659295b8544a55874b5470f331af94e6c21a17d6a5eb2b88296e7f155db6401bb66eca45d633a87
TLSH
T14941E798AAFD1158F3B76F5AAFF6A86D487FB8372E07C45D00110D4F0A22A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download

4e8a71c4-dc1e-4518-bea4-ce9b402ef1d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\4e8a71c4-dc1e-4518-bea4-ce9b402ef1d9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12362\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f356c09c-9068-4661-9962-5b870fa9e2a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\f356c09c-9068-4661-9962-5b870fa9e2a8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a15b8676-0ec2-4822-b6a6-01161f647649.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4104_1497750255\a15b8676-0ec2-4822-b6a6-01161f647649.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gyjnmshf.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msamtry3\gyjnmshf.exe
Size 5.4MB
SHA256 8fd9a7fcc351621c17be5105c3c12ea9aac490b838c3898e90b4d96485fb5fd4
MD5 25122714f5bc2b7fd605f2317489e544
SHA1 3986981047490bdbddaae88cd5a2a10324ed6930
SHA512 d898823b98c172030111787dab40b5362302fb468734fd64dee54158199d17d3249311a6703ae0160617e13d3cf4c8f9b2dc348d1357e5ea2767c10b466e8f4e
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMK:9XhICteErownP0oTcMsABqlDQkD
TLSH
T180463308B3A80DE1F9B3D13981665621D473B4254BB0D1CF43AC9A662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads