f72e282b2746a5c808a7ef2a53cdb42b10ade35fdf211b9228766d1721092253

Analysis

max time kernel
3s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.4MB
Sample260910-crrxrswtfy
SHA256 f72e282b2746a5c808a7ef2a53cdb42b10ade35fdf211b9228766d1721092253
MD5 dc1c81e4b938f86e1b9f4f9251322d5e
SHA1 6488ce4df7bdaf02059ec9ce6001316e66cbdfa8
SHA512 9fef9795c7e6b72e6708681c7237cf87687dd25d1e6a956c093a1e95cee4a3275f1db2ec0b0c1e4a8b406bd580969168572b69531a42bc7dd598445fe5d76666
SSDEEP 98304:6sgtXs6OICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllbHuZMSQ6Uf0:+Xs6OICteErownP0oTcMsABql9oUc
TLSH
T15E463318B3A819E1EAB3D039C5665221D973B42547B0D1CF03AC9A672F637E0AF7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wa77yr.exe	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wa77yr.exe	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes dropped EXE 1 IoCs

pid	Process
4228	f8pxagjl.exe

Loads dropped DLL 12 IoCs

pid	Process
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\jh1hb3nz\\f8pxagjl.exe"	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
342	ifconfig.me
4504	ifconfig.me
5818	ifconfig.me
6326	ifconfig.me
6615	ifconfig.me
7497	ifconfig.me
10370	ifconfig.me
11471	ifconfig.me
178	ifconfig.me
2800	ifconfig.me
7211	ifconfig.me
9657	ifconfig.me
10440	ifconfig.me
12158	ifconfig.me
110	ifconfig.me
349	ifconfig.me
3373	ifconfig.me
3793	ifconfig.me
4371	ifconfig.me
5982	ifconfig.me
7970	ifconfig.me
8384	ifconfig.me
1840	ifconfig.me
1856	ifconfig.me
2157	ifconfig.me
6450	ifconfig.me
8752	ifconfig.me
9948	ifconfig.me
10484	ifconfig.me
11586	ifconfig.me
556	ifconfig.me
1171	ifconfig.me
1275	ifconfig.me
6115	ifconfig.me
7822	ifconfig.me
8603	ifconfig.me
11372	ifconfig.me
11683	ifconfig.me
196	ifconfig.me
1979	ifconfig.me
12236	ifconfig.me
12439	ifconfig.me
12463	ifconfig.me
418	ifconfig.me
1076	ifconfig.me
5406	ifconfig.me
6079	ifconfig.me
8248	ifconfig.me
8957	ifconfig.me
10025	ifconfig.me
10207	ifconfig.me
6365	ifconfig.me
1224	ifconfig.me
2562	ifconfig.me
3451	ifconfig.me
7355	ifconfig.me
9002	ifconfig.me
11734	ifconfig.me
12335	ifconfig.me
410	ifconfig.me
2162	ifconfig.me
6558	ifconfig.me
8587	ifconfig.me
12233	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5592	cmd.exe
2836	cmd.exe
4804	cmd.exe
5156	cmd.exe
5652	cmd.exe
6088	cmd.exe
4432	cmd.exe
6416	cmd.exe
6728	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2496	msedge.exe
2496	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2496	msedge.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 5356	1388	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5356 wrote to memory of 5592	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 5592 wrote to memory of 4312	5592	cmd.exe	92
PID 5356 wrote to memory of 3356	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 5356 wrote to memory of 2496	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 2496 wrote to memory of 2052	2496	msedge.exe	95
PID 5356 wrote to memory of 1140	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 5356 wrote to memory of 2976	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5356 wrote to memory of 2760	5356	2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	98
PID 2496 wrote to memory of 2400	2496	msedge.exe	101
PID 2496 wrote to memory of 4796	2496	msedge.exe	100
PID 2496 wrote to memory of 2400	2496	msedge.exe	101
PID 2496 wrote to memory of 2400	2496	msedge.exe	101
PID 2496 wrote to memory of 2136	2496	msedge.exe	102
PID 2496 wrote to memory of 2136	2496	msedge.exe	102
PID 2496 wrote to memory of 4208	2496	msedge.exe	105
PID 2496 wrote to memory of 1316	2496	msedge.exe	106
PID 2496 wrote to memory of 4208	2496	msedge.exe	105
PID 2496 wrote to memory of 4208	2496	msedge.exe	105
PID 2496 wrote to memory of 1316	2496	msedge.exe	106
PID 2496 wrote to memory of 1316	2496	msedge.exe	106

Views/modifies file attributes 1 TTPs 9 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5600	attrib.exe
3468	attrib.exe
1276	attrib.exe
6164	attrib.exe
4312	attrib.exe
4472	attrib.exe
4084	attrib.exe
6780	attrib.exe
6500	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-08_dc1c81e4b938f86e1b9f4f9251322d5e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe"
      4⤵
      Views/modifies file attributes
      PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff80628c188,0x7ff80628c194,0x7ff80628c1a0
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15997635052938835082,12875103573726411769,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:11
      4⤵
      System Time Discovery
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,10378149015697032074,6151043355253757630,262144 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:2
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,3692855952919198146,5995391950404519206,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,1184600935553024235,9782283653290847246,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,11662036898593798810,8699960135804542745,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,2214024676976708708,4234863774549132913,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4340,i,5825584899271736218,6402300582130866293,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,8278023459739261028,14183535670994093498,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4660,i,11059303502160501477,5058576354692865039,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4924,i,16768307043723862816,7040516950779595571,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5072,i,150152974026993820,3062909488652947765,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5936,i,11829715847801703509,598783122694087800,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14901263437519319822,16132339128714396658,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6276,i,9607984985774316415,9803762240750915433,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6460,i,7681941953930853870,5026788785850470592,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10601536156920552613,17590506058430943081,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10601536156920552613,17590506058430943081,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4008,i,17979471424723080517,15793828941498063362,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6228,i,1470203090140975358,13395320418507214658,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5852,i,4517330000134093583,12670799446764600491,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6420,i,14547489096901420771,8578650465901330573,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6128,i,335336058467182646,15380631312377180447,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,7685449914632872359,8694676521408799077,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:14
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2268764508701696235,4197318765051826641,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6784,i,373687927106573726,7536997412623724492,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:7348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6672,i,6279775510022751014,5768473547526554081,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:7364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6824,i,11545017523931242441,4793228691377352227,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7360,i,4710547884063399558,4421929173518958859,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:7380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7376,i,14046142105816906560,12505676511572427971,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:7388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7412,i,12498558746274013666,821505479782748054,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:7396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7440,i,8242092398947219239,9250092672900327200,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7348,i,14335912897758237815,5374567311864213555,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:7372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7452,i,4168532573899108680,12814122155312263875,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7464,i,4088136531285062131,2838589640973147545,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      PID:7420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7540,i,16902242622717589320,4356962429310681261,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:7428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,15682838892118779784,7197543929748418593,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:14
      4⤵
      PID:7436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7612,i,6201473171685239341,8191601366863764757,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
      4⤵
      PID:7444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7856,i,10970204264070900890,5644260692781832889,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:1
      4⤵
      PID:7452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7816,i,9561712961762509328,13370380155512412481,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9032 /prefetch:1
      4⤵
      PID:7460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7852,i,12547462508221672960,16600767973022447827,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7916,i,15821645279311342321,6716875408899279199,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9128 /prefetch:1
      4⤵
      PID:7484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7892,i,2121406481822741198,10658469279395563119,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
      4⤵
      PID:7476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8036,i,11493001351210821876,16723588898485652866,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:1
      4⤵
      PID:7492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4900,i,4324493629202568657,18227532359598971574,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
      4⤵
      PID:7500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8040,i,12800110739061338353,11337166411230783721,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
      4⤵
      PID:7508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9028,i,9569857646063387762,122512362853636747,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10716 /prefetch:14
      4⤵
      PID:7516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3360,i,4696326627081465835,14203142421778372192,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
      4⤵
      PID:7524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4892,i,8530177198435026138,15069646394581190743,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9204 /prefetch:1
      4⤵
      PID:7532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8064,i,7170418281429939975,7710154423304000164,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:1
      4⤵
      PID:7548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4656,i,3855829154816249912,4581442293361724741,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
      4⤵
      PID:7580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8184,i,2393414270088358326,4459370429970764227,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:7572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8120,i,10106268989890343603,15126557584369484237,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:1
      4⤵
      PID:7564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7732,i,11781601321815379291,13999624678125748152,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:7540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8088,i,2388931544913792709,2046316790728216409,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9248 /prefetch:1
      4⤵
      PID:7556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8236,i,3073633579252305843,2699941915821821400,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9508 /prefetch:1
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8252,i,17603804312596371759,9149707159017473913,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
      4⤵
      PID:7600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8264,i,1376849256862943376,4921767778596585292,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:1
      4⤵
      PID:7616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,9913046510100160110,5056149897326869239,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:14
      4⤵
      PID:7632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8528,i,15352687101096027115,12859633174011323848,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:1
      4⤵
      PID:7640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8464,i,15251918205633233747,2023201625538462574,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8280,i,16593934582952548785,9701035452902358411,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9524 /prefetch:1
      4⤵
      PID:7624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8424,i,8219907664111074174,11882352491448907027,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
      4⤵
      PID:7664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8460,i,2520205650000109672,9217955322484345503,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8316,i,2592321743668903140,7179371608244920233,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9556 /prefetch:1
      4⤵
      PID:7608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8408,i,16322625850443751650,11926453489515411794,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9616 /prefetch:1
      4⤵
      PID:7680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8360,i,13777322224082994824,4266410469154452478,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:1
      4⤵
      PID:7672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8372,i,3783801655760729194,12410767885160513036,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8556,i,11584115446880208244,10606910222116939388,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:1
      4⤵
      PID:7696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=5020,i,16604178415996028265,12074085081064314450,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10432 /prefetch:1
      4⤵
      PID:7712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8500,i,7777213249959841042,5568852018829597429,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:1
      4⤵
      PID:7704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8588,i,15651569952158726497,14110386307437381607,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=9824 /prefetch:1
      4⤵
      PID:7720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=5000,i,2356045754483449735,7837575447360620042,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10484 /prefetch:1
      4⤵
      PID:7728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8760,i,18073693270462210052,13177230297258916188,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:1
      4⤵
      PID:7752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=4216,i,10158148588868313035,7395380049845900701,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
      4⤵
      PID:7760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8828,i,11105264804499810559,14740287556218074101,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10536 /prefetch:1
      4⤵
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8744,i,14180072530874625329,13168586662303863073,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10452 /prefetch:1
      4⤵
      PID:7776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=5052,i,18180379604093889738,12049951315584360321,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10440 /prefetch:1
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,14513274407922679451,4967652034474745312,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=11104 /prefetch:14
      4⤵
      PID:7736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=8836,i,1921818516577184186,6209297982901051135,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10596 /prefetch:1
      4⤵
      PID:7808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=8948,i,6662653131534324454,5681785721600997610,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10636 /prefetch:1
      4⤵
      PID:7816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=3448,i,7506450846487546842,7172648288207661384,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:1
      4⤵
      PID:7824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=8988,i,1194676675830888989,3594430364885295605,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10676 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=8968,i,2951740380076228367,9297267225785578571,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10656 /prefetch:1
      4⤵
      PID:7840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8808,i,13994155931639737072,4399204958197299383,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10516 /prefetch:1
      4⤵
      PID:7784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=8872,i,8767780017980983107,4712608133883739755,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10556 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=8884,i,13355934768785797280,11094348865482087145,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10576 /prefetch:1
      4⤵
      PID:7800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=9008,i,51990133509802349,6073944076167190230,2097152 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:1
      4⤵
      PID:7848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11780,i,10123848589758056898,12181350798397635327,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:14
      4⤵
      PID:9388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9600,i,9311259203719880299,15301945350336089435,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=10320 /prefetch:12
      4⤵
      PID:10080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=17944,i,17881304086609896158,6376891906760734974,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=17964 /prefetch:14
      4⤵
      PID:9884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=11544,i,8728684482664390835,9062724785887620440,262144 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=11524 /prefetch:10
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9048,i,13123762080705983462,1751558348037480544,524288 --field-trial-handle=2712,i,1853517083264248974,6612873203391606391,262144 --variations-seed-version --mojo-platform-channel-handle=15796 /prefetch:14
      4⤵
      PID:7828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2760

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe
1⤵
- Executes dropped EXE
PID:4228
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe
  2⤵
  PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2836
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe"
      4⤵
      Views/modifies file attributes
      PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4264

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe
1⤵
PID:4296
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dthjerke\i28hj6ud.exe
  2⤵
  PID:3816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4804
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe"
      4⤵
      Views/modifies file attributes
      PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe
1⤵
PID:1672
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ctr06ct\vxqo0qkx.exe
  2⤵
  PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe"
      4⤵
      Views/modifies file attributes
      PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1276

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe
1⤵
PID:4624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\etj3him6\oomznrs7.exe
  2⤵
  PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5652
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe"
      4⤵
      Views/modifies file attributes
      PID:1276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe
1⤵
PID:5320
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvkogy1y\mttb1lax.exe
  2⤵
  PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe"
      4⤵
      Views/modifies file attributes
      PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4356

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe
1⤵
PID:3808
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pbckb0sc\pyzr5t5u.exe
  2⤵
  PID:5860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4432
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe"
      4⤵
      Views/modifies file attributes
      PID:6164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6428

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe
1⤵
PID:6544
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g0xk87vm\cqn2j44a.exe
  2⤵
  PID:6616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe"
      4⤵
      Views/modifies file attributes
      PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7116

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe
1⤵
PID:4356
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4fe828fm\50b9zio5.exe
  2⤵
  PID:6228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6416
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe"
      4⤵
      Views/modifies file attributes
      PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7048

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe
1⤵
PID:5352
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xo0uqs3v\hd85iq94.exe
  2⤵
  PID:7028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 18KB
SHA256 d813d383d2c9435351aaed9812ae34a0fdf906331636b2d6ec16126c63da8ab4
MD5 c0944f0437b44f015a05549bf473e41f
SHA1 c90da2e04a6ce3c0c0dcca90daafbd1c13b35c08
SHA512 31a766e4f2b88a53e9dc80237046757a37c55866b306f2d80c46641c063b8ebe56e65cde2629420c44b0a8b3f09870199b558fda5b1edf480fe4cda641e1e51d
SSDEEP 384:iMGhMHet+zM1KbfffI2w1dXZSwMsBFt2mlko/LOIKXYHKlp:iMi4e4wE3RwMs1lko/yzYHSp
TLSH
T19182CF81E8EC54ECE3D28114AEF4B8D5FD2580FE6F49AFAF50809CE5BD0929B5930D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 207KB
SHA256 77b8c664b56079854b529f8dce83ec563be390a172db3404a07f07e8c76483c6
MD5 6ead202e2e058f5f4a4f72456e037ea1
SHA1 1598df005ea455bb521d9d4c3d8b54d3dd561435
SHA512 9ac1c74ba8d42073d3978f75809c90266e47ca7bf83f5b85706fff82058fba894d54d321f32051527a2c2e20b399b5af98d65edf183134f5762606f706cf6f5d
SSDEEP 3072:ywiQKuAx0pGGagrfoJpixRl+YbfHwKJFQhBu+npFy+wi2S8WZNLEuvcMkOMiRS:ywif0zagrfoJpaRzbTJsfpcxS3hEajRS
TLSH
T1A32423B00BB063E1C7244A075A2CC9E27A0452EF46F1EF8F9F3A796F9612E5D47606C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 72KB
SHA256 dd83966bae3769ff6bc4b2afcfb1cb85c546251520b85688f74187a8a6071b52
MD5 6b59856d369841e602cd3c4be56fe996
SHA1 ba823870c302724a2ef2d3c9f94a09b3a69def22
SHA512 1ee73fbc3fe9850df68f8c1339c1820a0a8460c3a960bbe6662e39117c831551207e5c0b8173bb8eb583290baae665cad68830b893e66d5c4f29d1ca2962e6a8
SSDEEP 1536:lC8iEMApX0xF8F/yrjW0fNv345O7JZLkz:lZU0Qw2/3el
TLSH
T1A47302A0FF28E6B73E72A57D1ACA5BCC39EB6C875CC53072C26A43F6085C01E548546B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003f
Size 76KB
SHA256 d665639b71cc94cece14c9e7a93ba6169f2108f3b997b420f6deec5fabdb3a11
MD5 0b1f0f8dee114f1e84ab6bd3d0f86c8a
SHA1 2eb0bc085317a32238c54822ac7d5ff90a30ddba
SHA512 3b905e29ec3ced551070e670971d6899212224a7c0239d04c8692a317da2a1e2705073308418f94c18bfa3aa7040e48efb527d873d2bba9a45cd5570abac4d43
SSDEEP 1536:v1SUrqoawW8l8uLlfPAJeTZHaktq20VesO02KSBmlysuGeqtCZ+UWHXdnOx:tHF5l8uJfYJeTIktMVtnaCysuxZ+HdOx
TLSH
T1F273123ADD131CE6B1C990EE5BFAB824666D74A292380C5437D9FE6E688297018317F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000040

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000040
Size 77KB
SHA256 570720ca89afe8a36c2f047373d19fe88fcde9a29129f211fdace6f22e7ba747
MD5 f93ab30819a84316cb1a004f4bcba17c
SHA1 acc1bc850ca44cbd669433867becc71a3effe2f0
SHA512 3addbc0ebfe990c356b5bf104170033d9ad1ddb7cd36454a939adbb3cceb2f372f50385c525d8eed6ff1db9c7f62acfee62b2ebdde6ec9a8652924a279e62649
SSDEEP 1536:MJkcTd81Zv8jpbzTG6kDrwQTI2vqxH1R88J5oPmQnJs2PzbUZQ/5OnTL+KGgIuhB:Mac5812pP66kDr22vinvYJHzWcqTCKug
TLSH
T1E17302B269D44E06B58A57E8DD0F32E6A11387C2BB503829455174ECBCCFCCA29CDB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 111KB
SHA256 be57d664d22e58b862355d9281ab172870773ffa0fe28b70a48fbd1002265d5d
MD5 9627db6a95f38703290e166731c5b5f2
SHA1 f8a7dc6808a90e3ca2ea1461dbd2758c73198a0e
SHA512 393d83c69ae7394ad1be2a7f095f6012038566d8e9dd72d407cfc59e321b40764e9f8a25a93883d136fe4536d3fef4709a79e85a3c90b33987b47444d609095e
SSDEEP 3072:iUxdXs2J+MOCfhYTWknI39YD2nyNkXPkvYIZe0Z:ikdc2+1CAWeKYDWyokvY2Z
TLSH
T10FB312C1F5D22656033532EC43077CA2F320DBDF4DF642B1EB9047AD1B29A9E055EAA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000042

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000042
Size 124KB
SHA256 840a686a6cc6254ea0c3b52826cfda2692e33ad10f4022f6e1cc728c11eea4b0
MD5 21157e9f3148496044b9304e604b7542
SHA1 d0bd270d3b4c710170958fbc7bcab5862d1e3d3f
SHA512 1a102cc9eb5fb968ef5844ea7016b19405d3e1329776456c70f901ca7ab7451842e60026c3a2817f8091f904622dfa22235bd04a4ba1ec6e1f5eec0af47f3115
SSDEEP 3072:rsQUGTRbUOjTyJSxe+CuHRMe/FCJz2awiCeTucbAo2Yvs/:1rfTyMxe+CMRf/FwiawOXxvY
TLSH
T187C312C6EFA1ACB2BCE0FDD181C443211945CA45BD42406D2FEAD67E99CB85EA433793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000043
Size 237KB
SHA256 ede07a1040a3c55e55f18ff546e8bbaf620ebed6325399b549e67966308b1177
MD5 97c7f562f25b64c8ed0ff8bc8bf99074
SHA1 d69ae12c63a5040905cad9c9f32320ce33820050
SHA512 0c2ecf3ea579f24c7da9f75c9a17f05c473fd0ea806883611108b331ce48dc3cbcbcb96a42e869eaf01875bc9cbeaac4efe40ae932c15d22772b12f1e954d18e
SSDEEP 3072:x9YvOuJR0x8SaSYKanpmmpJMVuPG2Pv67sWxouz26cvi+7mzIJDd2koaAUhECzp:xavDyYKoom/MoRX67sqWv1qIykoaDEm
TLSH
T1473423E4531BE558ECD8472A05E8B52A028F5F1099AB8237E11D504B399AECEF05DBCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 269KB
SHA256 3c571c06ee84d740c01559d39082123449780a003dff1be2020967c58d71e411
MD5 f63651937bd694efb6f83a95d6eea52b
SHA1 eadff96830481eba17e583253e14b1be508f50d9
SHA512 d63d7bd51ed6d52ae17070468ae6c38cd6ec463939a22c841b2ef71e388d6234c737844189bb60c344b45150ee5a5b406fdd78305c15933f98bf9de318d96e19
SSDEEP 6144:NNgrtkyHZpCY4xruK9atEtXrb4aP6KyeOUUcXZCThS9z:fgJ56pAKtX1YeOUUcXZCdQz
TLSH
T1D74422C855CC4174DD28A3CC64BFB774266ACBE42E9318B49325E9460C7A776FE321CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000045
Size 286KB
SHA256 a1eea5f5022b6ff0fc6015251888812f119b212ca097544575f25a0b296eec0b
MD5 ea9ba2aab885828fb9c804bd77430cde
SHA1 c1acb134189f959496b2c1d2239f8d3ac0fb61cf
SHA512 42bcaa72b448fa498b3128500260ff85309538fb6e4dff1091dca5398fce2fb0fd8e462c4572cd3db6e28d7bfe5fc8c3d8a11c37f5baaf7fee1ee064c819c3f1
SSDEEP 6144:2vdLKFmKI08gX8oxbW4TbGKI13Lx9o0MDamjWXUHXp3WagezIX3V:2aFIqb72bx9oUmdp3WweV
TLSH
T1075423BD9210006E771C7F58A0B26BE6BAF591D28DB0D6D93034FDF734610E26CE41AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 574KB
SHA256 4f6a424ed4cf8ac7eef20133774fe02839db9c585fdd957c0dd7c71442007601
MD5 1196afbd8d76534995f899b9f3b798db
SHA1 96080839fc17c6cd7f40aeeaafd9c6ce30381cf6
SHA512 f20d8b7bea0c380237b01b00eaae2b5bbf71d0a6e0dcc8c95940dc4981505c975f14c3215cf028bc8a0c67733cf0d394255d2e4d88b10f78406eca88a903dd36
SSDEEP 12288:Znl/q7lom64+deqzfbaqlQJszTJTM8XDKJwPU9Rffgka7fCc8N/cVI:pQCAKmRSzT+cKJl9R3BQqcQ/cVI
TLSH
T1C8C4336C1FDA0BD2E2C7A674AC9321CF11E419B7DD2AD652B33E06BF4DA30C48523656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2699a8c9b1070727_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2699a8c9b1070727_0
Size 270B
SHA256 bfcac67e2623a0d226638ea45082d93af5a5ab2fb4f021e386addbc779177b7f
MD5 cab824e1c72c9bc627c71188494b4618
SHA1 0036cbcba1e131c4402e9d70c602be0913579f27
SHA512 bbce7638aed846a2570357de1c64e93281045c92e1b3ecdb6e417bde86b55128813856a662932b92d9df04e95331dd3dd9e461651984791e2eabe4150c0a9ebb
TLSH
T1EFD02B9B000A9424CD348CF2C26AB58ACB7BC615066E8240A11858F33097235FA2B616
MD5 SHA1 SHA512 TLSH

Submit Download

287badfa90dbee2e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\287badfa90dbee2e_0
Size 290KB
SHA256 0a722c9fa320a8eb9cbc1ca85b0e69c0d6819a79bb3b131dc8051d065d285e18
MD5 ff829533ff5c02234837b8ffe1b755fc
SHA1 2e5da180613fce9e876e5193097ed1503563eb64
SHA512 783e517398c83051a8f1c22c0bdd8de504b3dbfd942c005b84473252beae929d4295664246ded53c81e488259ed634de4bc32ce22353448c96135250daaad12a
SSDEEP 3072:YfTSrIgQYKGeV/hoyphAKKFcRDvvcS+DcwCl2K1mlghEYNxOXAl:Y8JQJos+KA6DvvcS+4tln15hEY/OXAl
TLSH
T16C54C4591790EE25CB3663F54292C953A73590443FC7A72331F4A33A2C5A3E25F9A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28ab18e614d1c673_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\28ab18e614d1c673_0
Size 230B
SHA256 9b1e055704f0de99c2be0ea7809d3322102bbca7fcbfca8b0c1fb3344779d52b
MD5 aa399b5fa0a18f39ef61211f34fd05cd
SHA1 1d98f4c7c8e60eb6f9d3b061d4082da5c0886592
SHA512 d4ac43ebe5923e05a5f96abe9c67f10c54b450409d586737a8fe1a29362354b6576bfe1b3a80c97b4173eec8c1503a12163609c9ab426def7c99f77692e0179d
TLSH
T1C1D022BF040C0A20CE39CEF0D9BB3109C243407C9DDCC2C58100B4B332298B1B84D911
MD5 SHA1 SHA512 TLSH

Submit Download

3be5d8b25b677be2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3be5d8b25b677be2_0
Size 2KB
SHA256 58065b10c61e2f5ea4a1fa79f1400bab5596af1e3e094135e26bfb3b613659d9
MD5 1e4f41cf71e697cec82d3ef0452855b0
SHA1 94d01138972ff17484540b7fbe417eb979fd77ac
SHA512 d4b7f550980820caaf77a3580db4614699a7fc854400fc177a94b8d594185ac3d4e9ecb76c96b92312bbe33d44983246254376da8fac0a8cd52a32e77cfb540f
TLSH
T16851F93FB5081F08C1D74CF8D6991C2886D9D6940388CD0AA50D0B39F1531F26FCB7A5
MD5 SHA1 SHA512 TLSH

Submit Download

440d39d36fdd84ba_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\440d39d36fdd84ba_0
Size 55KB
SHA256 49a36f2be5c42d0b078eede642cb190ae8feb2178080e4d3c5a914b27d3e12e8
MD5 ff54e5cd63fa1376e20e70911967c22c
SHA1 83c1d114ac50856545918640267a3ca727311f3f
SHA512 c329aa06f10e1883321427a7a3fdc36caf40a9c4751862a4c9c29194b1a739d24ec80c2ab92422d3c219734e685a20496f5a4118b1ffe3eab20c3204348bec17
SSDEEP 1536:B5F9t5XyTqP/Zi2dSxszN6b6q9QSd3ISh6ytW5muicg:t9tDj5FVmyg
TLSH
T1DA433DC58BA1BDDDCD1153B016924A23F7E290081ACEE61303E2B5353E846F16DFB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

467c6a8d21ab2e58_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\467c6a8d21ab2e58_0
Size 5KB
SHA256 d24ad9d222821afd1efdd208d87ed57c3653b4643236907b5e51285a16dd3ced
MD5 6166c50cc1eebd3e7e8e5cd9581d7d1d
SHA1 de3e6b6f1d0bb4bfa8be7be8556895aeaf5190d7
SHA512 950a8344d34f11a16be2bca1445f7ebf0559686bb506c368b3007d5543050bfb2f28c73be2d42e7ae2e5f47cea9b8520f64eda00ea897ebbcb738a2c4f086172
SSDEEP 96:UveNbH+2MjsU7QTeBJ5D/LCdiqP1S87qF1oH2xQ+gLIGmak4+pDIyl7FVMfMHC:UobeiU7GiJludVPPpH2x/gUDj9TBVM9
TLSH
T16DC14B03F7816F6A5A8BCEF64AFA6878153E4E0A27297E79D3C0135DB6046D1434771C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f19b4997cb2c68c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f19b4997cb2c68c_0
Size 371B
SHA256 a685a9cbff7ef380fe15b639e7a843c03abc57e6f11a2ab36da6ce043e5c17a3
MD5 9f0f96aac18982a4914156370f424ec4
SHA1 0a73d76a8c956df959ad7d08af7c45637af9a1f9
SHA512 24d0fd2b91a32f0f168972018e254abf54053b8dc0b19d011b18daef2bea31f2b7c7eae4511c27aa934686b24a797683ca5eec89a865d600cd1369472eb61f9b
TLSH
T14EE0C61FD00A1D49FE788EF882523270F12F881A26EC43E08002B8F223C8AE0AA84003
MD5 SHA1 SHA512 TLSH

Submit Download

60fbbbf338ebe307_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\60fbbbf338ebe307_0
Size 283B
SHA256 909bf602ca35279bb11adcf868ec3aeab3c614393c36d33d80427de52bd353ae
MD5 74b7300d5d60e941caa5b039b374c757
SHA1 2e57682446d3594b3888c7174b7d9edc744c2041
SHA512 9fe0280e127a614b6af8383723604e5775c68ebf88d707eb45e6bc5d01dda4de961c9df634a7f07f3d927c2fe4dbcf547d7867dc4ffe7dec77e003b7d1d892c9
TLSH
T1D6D02B9F181A9515DAB849F4C7A562C2CE52D40C8E5D81C1C61A55F73895121FA4DA11
MD5 SHA1 SHA512 TLSH

Submit Download

8b772c019ba5cedc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8b772c019ba5cedc_0
Size 242KB
SHA256 dc35d79c46255c726dac210103cd32788799711834e6546c15479ae9ac0cc77a
MD5 be5581852fe00b6a2c18af5c06135e24
SHA1 a5a44378b8aecbb05826417f9753d79422a40c97
SHA512 7014a7357962e10333613f0005dbbc947eb9bb0a8d454276a2bc16e9b63cf4266263865e293fe09a6454fa3a0080faea0b629593ecd7041409677f23fc45d078
SSDEEP 3072:DXBATT4u19MNE2mVqomQ4UNLSOSyKAmuCor2Dzt9pvKk4A6qMCReDj:DXal3OAmI3v2dlADj
TLSH
T17734F9464750A667CE7653F520A79923A33481042ECAF72B21D1F3397C462F16EAFD8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f8a886a107db9bc_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8f8a886a107db9bc_0
Size 216KB
SHA256 98e0d67b2893e529964cf605c505736016829d1f86790ef8a25e36983da20468
MD5 526611a396cea55290b6912fdf7ffb81
SHA1 d26a46e0ce56434cb0ab5d77d83edc443d8dd4a9
SHA512 f6cf424894098e46c215df590ac89cac04cf3225c4987ee31721864e7c29712023826d54442f219c1469800f9c9d9165dc8a0ce40db984616088cbb4dcee1de8
SSDEEP 3072:L7s1QYb1Gg1OajucgTyi1H3KmvrQsYLYFMr8nxt0IXhUAD8p8:XglyVt1XDvrQsQYuf
TLSH
T19924D7065380FD91CB7A22F6DAA29A56AAB1484C5EC3F72361F8F2357C4A1D11DC748F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b64d5b832a58a940_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b64d5b832a58a940_0
Size 602B
SHA256 25d843ecd085e79e4b0e56f2467cfa258468f669f804ffbc0ec524e7287ae23c
MD5 2556216b7e9ead0e678a009623a47900
SHA1 e09fb3a7008be3830dc2bdb7d1dbf14b03497ef8
SHA512 c186301d22522dbc685830b1a5f411ded06fed2bbb55fa29a353a6ce647e6df145c79546a06d632ed4305e51a39d6ea06fe7eca64286d0b3c7eaa773c4923c64
TLSH
T13EF047CBD2741914DBDD6FF4C649DE565753A85450EC619CD80280D17826C74B9045D0
MD5 SHA1 SHA512 TLSH

Submit Download

db0f556319eb9321_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db0f556319eb9321_0
Size 8KB
SHA256 3ba5087d46e8e3536529df38b01415a64854c812561c2311f5036a3e76639073
MD5 c13e66a9ad13d21dc071844e01ad4b8d
SHA1 17c06dd0d0e7051dc0ce8b4efad7630a32243c7b
SHA512 383cbdbbacf4107746f02010be5014be1a62873d478094dba106fb1eb17148acdd56c7c74103bb6f7b8ca2debbe3b899ab85d01810dcba5b5a2ece86894d5f8a
SSDEEP 192:9/b4atJRbjILT5CgUkh86SHHB3z1oN8xEsMhbmWM:9/b4atJRnmYB3zDeXM
TLSH
T13C028C4AF5970FAEE243C52799A61736978F72890F4409C0C55AC727B0DC941C7CCBAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e14327e3bca2ac44_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e14327e3bca2ac44_0
Size 270B
SHA256 7ab876056e4b257bc6e9bee84468ddaf4339b228434d9975cbc4afb49bc47209
MD5 7b23b516ebdb79f45645a50af459a369
SHA1 82d8a46d698cca9f0615e57cc57a69ff1ad9cf20
SHA512 f52d5fcdeb6f02c2fe2109815cd0c9a54b6e582dd280d5d731795de115a02aa5da1308a03dc39254651bd9f7f6e9b9e2f63cb763fe3146ac2debd4dab95d7ea1
TLSH
T1EED095C7001D9418CA278EB0C7AD6189CB9350540458D7934901509735D3570E53E359
MD5 SHA1 SHA512 TLSH

Submit Download

f7ca9dfa2c0b230f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f7ca9dfa2c0b230f_0
Size 1KB
SHA256 1fb4a4952505b5ac361c67b4606df9e6dae71a30cf3fd9a1ba1bbfc66bca3d89
MD5 d9dd684c6fba9ece33e08f25dad76923
SHA1 833c1af86584db11f4f48a92bb4adb01985c5261
SHA512 33b87f4cadee4a2e339cdc88aaa248fb9f771da5f434b200957384565a0e60ab4ccf28065e35631623e90f408886d7fde183b9dc275dc674f5133397bf1fc264
TLSH
T1252151AFEB542B81CC000AF0C12361F453A6852848140DC2C18D7DF174A67F6B6D2313
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d42fce735cd785ee7a29f4a8657b5b4adf4b88ba278a01f6fc9c1dd1b46f96d3
MD5 835d3ed9318d9621c8e7849873e28627
SHA1 91e95c7b06ebf18f98106713bb29474060e472db
SHA512 981171d04a00002cdbb89e4dec94113cd5db4d2c0de8c904484bf8dfee8158e046114c067ef7065f3d7381a43a0bc8541ae33360b09ace3b96886639aecfb840
TLSH
T1643171B04F342AFFDBAF45B613D20A9D7330885B33036F911354ADB44A463B7251000E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 bf3906afc1920d4ea8309972840fc4452c341cf5cca0cf78f6d8ad36d96381e2
MD5 91b8ad85cb006cb2bfddd1622e275de4
SHA1 b232e9f760f9a2622c35728b381177389f99218d
SHA512 ea9b068b92a4fe6f7a1dc609c04ede60d8ebe571835da9048ffceb75e11215590971bdaf29220e082218829f39fff30a290d36558902242a920d29c804179d80
SSDEEP 96:DF3Ig12jrVaaZwfFsRoIgQiGFm09QW1SbLVMW:DF3Ig12jrVaaZuFsRoIgQiGFm0+W1Sbl
TLSH
T168C1ABF783E4963CDC6192F0AA152E2BCF290914936C3D5BC9D19F5BA7E2470E101A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0e2d9a79af5c008fd2948b7f9f07b71323ff5edaadbc35e2d39a00346b24bc64
MD5 5cca8131bd445d2b4f3ca1a039b45a2b
SHA1 964c3abe340904676f0c92200379576b470da98c
SHA512 af68e33bb525768f206a5b2a960bc6ccea44bf772ee8b6144147521469d9503f9d3f465c35cc34bbd29255a56ea63f5812c08d366ee88ff004182d261e1030e2
SSDEEP 192:sxRvrCO/fys2YgLZTYYeNzoA8pKK4ZF9Hg6+WNs1xr2ud3LJYX/YBq3gR8YZGJIm:sxRveO/fysWlTYYN2z5gbhm/lFz
TLSH
T17B52E9166A39997B5CDBD319FA15BB13D2F61132A0D11F44B7FC8A5C00E76ED220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2bb9bbcda337528f91a6984526cb6e4a54064a4df4ebec3421b7c792dbbd7128
MD5 356c8d475d183794720c3cfac75bfe19
SHA1 f8c1631d8eda1f7c6da13e50445143de49e19917
SHA512 7293f9088f2e7c34248952c5aa685cd377528ffde675de8010d43e59fb16390f99fa9282af46988c5e2bce06448df34ff3d1ba50a194c51066c9b5b878690e5e
SSDEEP 192:sxRUrCO/fysRWgwGqNzoA8pK6dCF9Hg6+WNs079WdnYX/YBqnGR8YZGJIgVWJ:sxRUeO/fysHp5Oz5Pas/fFM
TLSH
T1F342C9166A389D3B4DD7D359FA25BB53D2FA1132A1D11F48A7FC8A5C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32d85736e9d2c4e3eb49533da556dec95dfc9d60851f6c01c06df483609a00df
MD5 c7afaf109bd62ee567e3b53363c8cd7f
SHA1 e79ef08ec523a70ae6e5d60b2b2f4d6c8fe890c0
SHA512 69128729a95864885b3581539354fc8d35796c391d559228dda0bb83e4b65124be4b7890507b1bda6e8c91f5f98c6464e166b56b08b968d636ae10f3bdfceb68
SSDEEP 192:sxRvrCO/fys2WgwGq7zoA8pK7BCF9Hg6+WNs07l4v9WdnYX/YBqXGR8YZGJIgDmi:sxRveO/fyskpXJz5Pyas/XFJ
TLSH
T16852D916AA385D3B4CD7D319FA25BB53D2FA1132A1D01F48A7FC8A5C00E76ED620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f11e77b25e8731e46fe025732cb32d52f3bbe068c7c0f411a27b933635958b76
MD5 c09a8d9f281915f7b73718a627fd4fa5
SHA1 3b32e6128baec0cf6f1ad8573989aee68631326c
SHA512 cd73955413499295a95c5f8d07ed9d037871c6fd82b718c4f51ee2a81e211336b6e6a812908d358607b2b038a16741d6d17d506a20d238746b923b9f65a175f8
SSDEEP 192:sxRvrCO/fys2YgwGq7zoA8pKK4CF9Hg6+WNs07l4v9WdnYX/YBqTgR8YZGJIgDmi:sxRveO/fysWpXNz5Pyas/5FJ
TLSH
T17E52D916AA385D3B4CD7D319FA25BB53D2FA1132A1D11F48A7FC8A5C10E76ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cef1b46b3eab2beceb40394602f3b6bddc4b38deb2525155a9a2b5c1a0d139c0
MD5 cfbde6e8d0bacff1bc6ead5a94d0ea69
SHA1 c4e2d12a43ce7c24d8754dd70e7528a453a34170
SHA512 5f6ce0d4353b0c7397e0deafd6f2ac50350f8ff5dd5e42b5c3cb151e75fe48e3660a5acfa11a5fb52d0ef6a3ab1d376daad84d5b13a1b92d7afbd1a576cd2c88
SSDEEP 192:sxRbrCO/fys2YgLZTYYeNzoA8pWUK4ZF9Hg6+WNs1xr2ud3LJYX/YBq3gR8YZGJz:sxRbeO/fysWlTYYNLz5gbhm/lFz
TLSH
T1CC52E8166A399A3B5CDBD319FA15BB13E2F60132A1D11F44B7FC8A5C10E76ED620B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 87142d72a65cea0b9c2d1cc7d49a6ef989a53f2e2737964d2b4c850d09375634
MD5 0a3d3a8debf7140d4caeb49167376155
SHA1 0cf28b3cd9382d28f01e82d5045b7f52a092225a
SHA512 c34a81c54100961c8e58392ecad938c4a0a46233efc9bf7cbeffb8c00eb6100a6c972ab1ae316c82e323dcf87cd88517fab27cefbad9950053bfe1f51ca5a798
SSDEEP 768:j26Hbo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVwVuwIro9LKe0U4:j26HbUE7MRWgs2f02u1jaP4wzh7k
TLSH
T17DC2CA6B640DCBBF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb78b84d114894aec44db259734d662b130781e8f4c6ed4440af8149b1b43aa8
MD5 225c5e72e854c8014b57d3f776edc359
SHA1 0736fcc10a50b0b112c85af2b8675ebab971af39
SHA512 494b2e37a616340533746cfb93e69393c4ffdf797a7f92e4cbae93184c254c525ba9234819bba972c9be1f3e6fc4b03b7ef669f95ad0030cab258aefeab2cce1
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEok:CENE8EzEnE9EXErE+EzEoEHEvEFEugEf
TLSH
T126A1EB50B03B4381393D760CD4788D5E81D2B8A2345DA5AB7B990665CF5FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0c55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0c55.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 643c6ffa175adb7ea127e99a57d4e854297e8e6717c50a67bec18b937620ecae
MD5 ffe2e720c209bca48cbd159c850ffc0d
SHA1 2cc86a848e9493d852e174ad2623d51e309312f7
SHA512 2d23e4576e4219ff6563e4bf3b36ce32e1dcd5e7a458056043ffb7f5b6666d92ed68d9815b5af3c6cb8f585758b7568e31aebae365d59227dca9853ee8ae20dd
SSDEEP 768:hrv+4UNbdz3J8/TBOWZAPONXyer1IRCzniBTeVH1SK7:hbsbV36CSIqnMEH1l
TLSH
T12303BF32E4A99E334DE2A3C5B14773437FB85057C6840790EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9ba101365728060afc33adbc49ed50cf6442bacf4049a5904225bb56a34b2753
MD5 edda85e1424e91397117238c198146df
SHA1 aef9e5378ba74045b9525ddb24746a2c3904a672
SHA512 95c464fbca230197d8b2a23bce9c15ddd5d803671256437aa6fdc9bd54c5592c0d5b4059c82bce05f3ca2c585737ea007925bff4d599b3c67c4c3c8d87ad6a48
SSDEEP 768:zrv+4UNbdz3Bv/TBOWZAGOONXyer1IRCzniwWeVH1SKk:zbsbV3hYSIqn6EH1m
TLSH
T19803B031E1A9DE334DE6A395B14773837FB8216785800B90EDDA5F8E068759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 131ffb2a3d8a048a75e53b718f7ddc9b2d83aea14c7452fe505600797fc26e4b
MD5 ee1841fcb69d728355f7a89f00777fa3
SHA1 348640e3ed207e237d3463c6ba4312e045bc5ee8
SHA512 819687a27bb05d18a25ae8a374b3ed2f939bb91f324cf79b952210d91acf1f288e4e33f43b62cac322f03002371de387c5043fe070dd8ff41993280201ddcb1c
SSDEEP 768:dFQ+3twgnj2l/EpsOWZAGGONXyer1IRCzni9WMghr:s+3D1tSIqn9Mghr
TLSH
T12D038D31D995CE3B9CE693C2B7067743AEF411A385C899D0EAD95F8D00C769E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0d48d547db895a4d2d83ee9b3bd1d53fd4893585fadc265a37bfcbd8e8e82b18
MD5 0ed5534ef30c59fcacb7aab4c8512d1b
SHA1 b16fb7997a83bb30afd118aa05cac7f4fdb2475b
SHA512 f6a88de3497340ca6a887dd00af1a065e7860ff624bf816fde7daac55b0e4ac7a639a772611cc6589a4c2eee5382c37b8042c22617f53ba02ee7112a00a8bf5a
SSDEEP 768:Z+3Vj2l/z/TBOWZAGOONXyer1IRCzni9WMghr:Z+3VGESIqn9Mghr
TLSH
T153F2BF30E59A9E374CE6E3D6B64773837EF8216784C44A50EEE95F4E048766E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9241093a9cc471a9d802ed06d0ad0277c3eccef25ccd34be95c9c01da2012155
MD5 05f5938a3de6264321b04712652d781b
SHA1 5ef1cac0f83558af022052a662f6eb83166e4487
SHA512 6f455bbbf6cf33b245567827faadd174cf022ca485002b292d4983af39f10b97424787d22b429e5f791a81700870a11b9a255e58fe722910aaca57565b077d57
SSDEEP 768:/rv+4UNbdi3Ij2l0b/TBOWZAG5ONXyer1IRCzni9WLpt:/bsbI3IpPSIqn9Lpt
TLSH
T12103BF30E1999E334DE2A386B10777837FB821A788C40B54EDDA5F8D058B5AE270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 feec2ead9036defc0290ef002a9ba31d7d70b47ed1ff65c3a59d44415b421034
MD5 b7c2b7a937a940d06a1d93cbe5df6d53
SHA1 92fd90b0f0405bcf19757855c41ab2134a597141
SHA512 e0f1cee65655606bc322dc17d093df63819b637b9fff5ced0e2ca167b63713a8fc00e2ebfa828234d178bfac3e453abb01c1c2ff17fc8918d9586ed681c01c17
SSDEEP 768:arv+4UNbdz319/TBOWZAGOONXyer1IRCzniwWeVH1SK7:absbV3TYSIqn6EH1l
TLSH
T19703B031E1A9DE334DE2A395B14773437FB8216789800B90EDDA5F8E069759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47829cfb-9e87-40ae-a9c8-841219e1fb5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47829cfb-9e87-40ae-a9c8-841219e1fb5b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\base_library.zip
Size 711KB
SHA256 dec46d5322f683372ac52a3dab1db5cf84e48161b04766b14e91e2e976c5d667
MD5 6c9cf464869bec5ba889b083a5acc9ab
SHA1 588af60e1c5bb3b4986ceb9733ba5a6532ed8fc5
SHA512 c5ea92102b5ea05ec1af055b371cd5ae86be7f227ab79d762dee424f7dd5e6528605f2b951151756b08241b87be0f1ae5432a308e9897610bfb19b90b151e201
SSDEEP 12288:IviYfyEfd372osQNRs54PK4I1OV0cGk10axuoQDSmhIi8:nYfyEfd372osQNRs54PK4I1OV0cGjsuU
TLSH
T11CF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2496_1857434342\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8pxagjl.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jh1hb3nz\f8pxagjl.exe
Size 5.4MB
SHA256 f72e282b2746a5c808a7ef2a53cdb42b10ade35fdf211b9228766d1721092253
MD5 dc1c81e4b938f86e1b9f4f9251322d5e
SHA1 6488ce4df7bdaf02059ec9ce6001316e66cbdfa8
SHA512 9fef9795c7e6b72e6708681c7237cf87687dd25d1e6a956c093a1e95cee4a3275f1db2ec0b0c1e4a8b406bd580969168572b69531a42bc7dd598445fe5d76666
SSDEEP 98304:6sgtXs6OICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllbHuZMSQ6Uf0:+Xs6OICteErownP0oTcMsABql9oUc
TLSH
T15E463318B3A819E1EAB3D039C5665221D973B42547B0D1CF03AC9A672F637E0AF7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2092-811-0x000001F898000000-0x000001F8983BB000-memory.dmp

Download

memory/2092-676-0x000001F898000000-0x000001F8983BB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads