Overview

overview

7

Static

static

3

3dffba50c9...29.exe

windows10-2004-x64

7

3dffba50c9...29.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    4s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929.exe
  • Size 5.4MB
  • Sample260802-a79fmsbb75
  • SHA256 3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 22 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 12 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929.exe
    "C:\Users\Admin\AppData\Local\Temp\3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Users\Admin\AppData\Local\Temp\3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929.exe
      "C:\Users\Admin\AppData\Local\Temp\3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe"
          4⤵
          • Views/modifies file attributes
          PID:2672
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffbd85ac188,0x7ffbd85ac194,0x7ffbd85ac1a0
          4⤵
            PID:3852
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,18422673400770989283,2997154254964717575,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
            4⤵
            • System Time Discovery
            PID:3244
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,9714983084602455334,2214051437505214511,262144 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
            4⤵
              PID:4884
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,2603291967685837026,8414087143696500385,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
              4⤵
                PID:748
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3332173380546305192,2774751025754280959,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                4⤵
                  PID:3964
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,17792891107526054070,10926188442493835923,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                  4⤵
                    PID:3208
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,976983727457807404,10519082803914409544,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
                    4⤵
                      PID:2612
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3926956561582489873,11733260639493265068,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:2
                      4⤵
                        PID:2704
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4412,i,13575820441364163443,4219949312199404444,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
                        4⤵
                          PID:3652
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4812,i,2024171421039694736,3846411447997088235,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
                          4⤵
                            PID:3176
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3572,i,8742001454938733831,13482215639574116359,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
                            4⤵
                              PID:1148
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,6275785612523508815,3975264740696302276,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
                              4⤵
                                PID:2532
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5792,i,6055149055709818048,16349490922476633878,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
                                4⤵
                                  PID:1560
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5936,i,12019082963860869083,9889368811531118337,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
                                  4⤵
                                    PID:2672
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3963385941294722535,4288460381316716788,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
                                    4⤵
                                      PID:4460
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6260,i,2297696389333436521,16987051341877080379,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
                                      4⤵
                                        PID:4236
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5388,i,7330996455384442969,12932791035722471969,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:1
                                        4⤵
                                          PID:1260
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5944,i,14496641279065022045,4611608560984090643,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
                                          4⤵
                                            PID:2552
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16005755890175436359,14709158127641972860,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
                                            4⤵
                                              PID:2308
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,16801732729788603229,3995936540423649556,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
                                              4⤵
                                                PID:1044
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,5915253696101228924,8833539701258718410,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:8
                                                4⤵
                                                  PID:2932
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4580,i,11860931867267707589,1732123027543045118,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
                                                  4⤵
                                                    PID:5244
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5300,i,16650515337455005851,36396462559072498,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
                                                    4⤵
                                                      PID:4588
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7460,i,15315640820970596571,2830129563146115300,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
                                                      4⤵
                                                        PID:5508
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7180,i,1427776189355015696,11723130422499623123,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
                                                        4⤵
                                                          PID:3292
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7428,i,15694599480096761065,6611794811572170258,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
                                                          4⤵
                                                            PID:3568
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7488,i,5400335181306608612,1999395482012798035,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
                                                            4⤵
                                                              PID:5468
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5484,i,9300453210449142592,14035886937719904584,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:1
                                                              4⤵
                                                                PID:5164
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7536,i,11203315353278804466,8003928503704369515,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
                                                                4⤵
                                                                  PID:2888
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7548,i,6360666624713653703,1330976083109080443,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
                                                                  4⤵
                                                                    PID:4116
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7644,i,2229576061407201682,9440992420702644128,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:1
                                                                    4⤵
                                                                      PID:5068
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7588,i,5490130493023722770,14980779711465738167,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
                                                                      4⤵
                                                                        PID:5456
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7672,i,13647752939937407800,18079723850513090264,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
                                                                        4⤵
                                                                          PID:4512
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7720,i,166027995850466093,6462271375080701697,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:1
                                                                          4⤵
                                                                            PID:4160
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7792,i,145709257186746781,12270945853820862389,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8604 /prefetch:1
                                                                            4⤵
                                                                              PID:1316
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7736,i,15846832798331182744,15814920322009414244,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:1
                                                                              4⤵
                                                                                PID:5148
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7652,i,8513371662845536225,14303661231063956949,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:1
                                                                                4⤵
                                                                                  PID:5556
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=5928,i,13055483465152940289,11428362766609395859,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:1
                                                                                  4⤵
                                                                                    PID:1632
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8176,i,2297899405521562760,12562340579387655239,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8688 /prefetch:1
                                                                                    4⤵
                                                                                      PID:6080
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7832,i,11177900396360089436,15723992647641421567,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:1
                                                                                      4⤵
                                                                                        PID:2480
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8084,i,9676999754407185200,12296814554552082785,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:1
                                                                                        4⤵
                                                                                          PID:5204
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7824,i,15212221828173828117,7479247110499046837,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:1
                                                                                          4⤵
                                                                                            PID:6108
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8232,i,230743057141920029,13835798353825424806,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
                                                                                            4⤵
                                                                                              PID:5184
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7756,i,15919812026117652090,15775626413238506641,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:1
                                                                                              4⤵
                                                                                                PID:5732
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5404,i,9388214376683635736,4843540906676482603,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:5496
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7740,i,16849122859146422765,6615065151969385020,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:5784
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8008,i,4285516156005186599,11206334902146348735,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:5568
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9632,i,14854000037709050390,5374245925147678768,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:6320
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11296,i,14152866742641455868,3708177146098735273,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=11308 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:6540
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8516,i,16081333610026198320,2619294036072244298,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:6676
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11504,i,8074768628283878071,5082824111566006349,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=11524 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:6848
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7428,i,5231860068595140208,11539722337451000102,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:6984
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=11924,i,2994830652156896171,10041193200491201047,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=11928 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:6472
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4520,i,17280699198953792860,15801356494761169497,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:6588
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4488,i,8765378402995676381,4449926848707886799,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12168 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:4148
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4748,i,14380012662380885996,18294362025990422295,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12304 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:6992
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12452,i,7091254761842512903,11035678362011747243,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12412 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:6360
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15185308093414566188,4009407002315619724,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12628 /prefetch:8
                                                                                                                          4⤵
                                                                                                                            PID:6724
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,15185308093414566188,4009407002315619724,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12628 /prefetch:8
                                                                                                                            4⤵
                                                                                                                              PID:6880
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=12868,i,1289390971916445723,1413830456704930013,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12876 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:6868
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=12912,i,2684518462714561063,11854203195945687796,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=12996 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:5296
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13128,i,12146178415817438653,18021320258269819894,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13148 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:7236
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=13352,i,6014161584697341878,17299295191473387039,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:7380
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13392,i,9126533975261075144,17119171551385003549,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13324 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:7620
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=12856,i,1492002605618328913,8810508256368692844,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13316 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:8024
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13808,i,8853937176647405161,4183559197982628407,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13860 /prefetch:8
                                                                                                                                          4⤵
                                                                                                                                            PID:8036
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=13196,i,11125142281346713671,10339438356472765025,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13668 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:8044
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13812,i,15680180801339993516,16378356322803116847,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13880 /prefetch:8
                                                                                                                                              4⤵
                                                                                                                                                PID:8056
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13816,i,6020898650151994849,11831879157857071512,524288 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=13892 /prefetch:8
                                                                                                                                                4⤵
                                                                                                                                                  PID:8064
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=14076,i,4283474814539619879,15824153796898918539,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14084 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:8184
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=13688,i,15817966132043480402,1574658037585606517,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14312 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:7540
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9720,i,17429540084262401210,1046564292813804079,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14444 /prefetch:1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:7604
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=14608,i,6564627796299586366,8819574290052512815,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14616 /prefetch:1
                                                                                                                                                        4⤵
                                                                                                                                                          PID:7720
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=14752,i,13500187305065809398,15359792125261498725,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14764 /prefetch:1
                                                                                                                                                          4⤵
                                                                                                                                                            PID:8240
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=13348,i,16656731418739238500,1319197893692368046,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=14772 /prefetch:1
                                                                                                                                                            4⤵
                                                                                                                                                              PID:8668
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=15464,i,4917245272466940556,2317346002406102533,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=15460 /prefetch:1
                                                                                                                                                              4⤵
                                                                                                                                                                PID:8780
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=15492,i,15284021671087044014,13289967371518899799,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=15628 /prefetch:1
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:8808
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=15792,i,2757134639085559641,11048962999423827456,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=15804 /prefetch:1
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:8928
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=7740,i,2495045080415199960,5061343214630215211,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=10832 /prefetch:1
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:8996
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=11288,i,2891209248624727181,2971653141849366548,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=16004 /prefetch:1
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:9064
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9520,i,15047527754476144787,916969509917676162,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=16124 /prefetch:1
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:9192
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=16360,i,3950642908341879554,17727616981334217001,2097152 --field-trial-handle=2380,i,3524966196108075957,14534935031657322369,262144 --variations-seed-version --mojo-platform-channel-handle=16364 /prefetch:1
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:8460
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:644
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:372
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:808
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4632
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              PID:3288
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\alqx581w\6livv4ao.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:4596
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                  PID:1500
                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                    PID:1736
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5236
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5484
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5800
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5868
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5932
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2944
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5256
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\de3mdr7q\ttu5n1bo.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                  PID:5476
                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3976
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5196
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:3292
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5460
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\chy2pf3r\2vqfz4dr.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                PID:5144
                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                  PID:5396
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:5904
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5920
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1976
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5504
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\7g2l0qyw\0rwi0scv.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                              PID:4132
                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                PID:5408
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:5732
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5864
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5920
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3732
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hn95q7yk\lj7sutf6.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3924
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:6164
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6300
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:6500
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:6584
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:6832
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:6920
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:6364
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r7vqnd5l\5jha7cvu.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:6484
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                          PID:6728
                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                            PID:7132
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:6404
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:6568
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4420
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:6872
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:7132
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:6308
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lc6ab6nv\dy4h5j61.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1656
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                        PID:6704
                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5284
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:7212
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:7356
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:7572
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:7452
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ucmpczzl\friintx9.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:7608
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                      PID:7844
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                        PID:7988
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:9692
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:10012
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:10152
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:9372
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:9336
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kgb91z8j\695omvu3.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:9412
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                    PID:9508
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:7548
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:7284
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5312
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:7548
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:9772
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:8392
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fmowdijn\5ljau5t7.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:9588
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                  PID:2760
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:5292
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:9392
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:10252
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:10276
                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:10300
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:11132
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5y8ztct2\q917htri.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:11216
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9awqnkx5\tnbs4bfb.exe"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                PID:10388
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9awqnkx5\tnbs4bfb.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                  PID:7496
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:5244
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:3644
                                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:10648
                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:4248
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2004
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\dwm.exe
                                                                                                                                                                                                                                                                                                                                      "dwm.exe"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:3864
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:11144

                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                              38f5805b-2525-47d5-b001-4377c238bf3e.tmp
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38f5805b-2525-47d5-b001-4377c238bf3e.tmp
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 825feb6bc8f88e06602112cb91fb05c7e2ee09d4efd8d05831e9a181addb2b7d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              3cbb5291-e143-45f9-b389-a2f0022df35f.tmp
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cbb5291-e143-45f9-b389-a2f0022df35f.tmp
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f1ab82484255d86d8dd4deecc94f46e9f0a5464ca4a90a845c26d38175fd4c1b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                                                                              • SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_00004e
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
                                                                                                                                                                                                                                                                                                                                              • Size 281KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1d87fb4c59266ea1e9ebd07a5904cd8fcffb4f3d083bba90f19df64708a11740
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_00004f
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
                                                                                                                                                                                                                                                                                                                                              • Size 74KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b38ed34fa62e7c143e92865d10ceb7f30651a104ebe72587d3ecc43ac9aaef9d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000050
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
                                                                                                                                                                                                                                                                                                                                              • Size 219KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a663b09109d8b2bf0818525c193d0e0323a20c7cb3575cd5c9e847e68b0ab1fd
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000054
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
                                                                                                                                                                                                                                                                                                                                              • Size 215KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c6d2b43320a3b0c1263e399893a3f1e7c9f788447d563df4c062097a27a00e0c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000063
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                                                                                                                                                                                                                                                                                              • Size 22KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000064
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000065
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
                                                                                                                                                                                                                                                                                                                                              • Size 31KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000066
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
                                                                                                                                                                                                                                                                                                                                              • Size 26KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000067
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
                                                                                                                                                                                                                                                                                                                                              • Size 88KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b80c29be82073a20f5ee94fd7cd812950e52f8939be3133ce92a61cb70dda230
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000068
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
                                                                                                                                                                                                                                                                                                                                              • Size 53KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 27ae2ed189f8d1a8a45318224e8b0903939b914d51e02a10cbcec7c363c1a456
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_000069
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
                                                                                                                                                                                                                                                                                                                                              • Size 115KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 323ef224cd86a9fa659c6e69f106baa5840b7ff47ad20b11090f03f932a7d4c5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              f_00006a
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
                                                                                                                                                                                                                                                                                                                                              • Size 118KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6eef74807e5129bf9101bb98f5d129e2ab7784ae48334b17521409a08350215f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                              • Size 111B
                                                                                                                                                                                                                                                                                                                                              • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1659e665ccb3aa42d9b9cd618a05859d0d22fd28061edb4167376b04f9e7ba76
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c6fc11ad38c547d2949b03080fe11a50b37a49bd53dc9a81e8fdce925c1ec276
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ce7a284f26491d58d3188215e3cb5a48b795cb4b855cb80670511cb11d28941b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 402bf60b06602fb76d39c094fc330edf7ce697e5a692038b2863fc146b2ed7ae
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1b938b6030c1decc2d370013bb346ea8a859e57c2e26519c7253be95d60d0189
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2f30cab83b92d3f76229c044e7d913dd33eb8f0a4b480ffb84cc5ff847198b6b
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 800fac40e0698edc641e3b362dd280e2a25ac93a349fdb97ed84a1a16e504de8
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 6a43bccdcbb8acab02f2fe79b7adb8737381af3689fd48c42bd6ad9f22b2678e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cfb4b9a2b6967bc6ce98273d72146907204db10e054c62278f9ca07c28a46ae0
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1e921ed6b261399e2f8c900ffdff98d69b20b27bf6efa6651ba197d624de5482
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 10KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 41d212f59cb85917b36307c0b26b67622b7aaa341b8f67e65f122d6088e8592e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 79811cc3a7b7befbefdf9f71048e783efa87948b91a12b90109c3b02db71b422
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 f20796aa8dd2d0d8d96d8e79f6f2c5c2a40c3adbdfe5a9bb9cb1edcc346734bf
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cc97f2c9326b00a0c15d4bd787a96a46e5f810d51058e180b28a3de3c213cbb0
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5822835eccfe987dc082486b41e8c5cff3b87923a8d1a535ebdbf998bc0d60a2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 aa77a29acfb6cdf50b466cb3eef0e75915573e255a71ef88e5c8d06f4e36b1d2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 21e4e2655eb2d82f73c8059d51a80c01d2dbad3e38b4437ecae9b021a9701b98
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 32ffdeaf0e26e75eb79da7f89e1e26c83e6d4bf26f8960bc9496cb103164d45d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 105ac85e7741fd37ca8b7563ca1175294c3baa675b8a4325ea79d727f9d4e198
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d7c1abd1d09e42f3df4833a10277a2242eb570546c0a3716675c6a2f5a144a4d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5ad83fb18b03597ecc8910a8df20b82abde429dbe4ff1ccf947e074d0d22f85e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 91d9a143de228e656fafd25fe12948883ddf6728017d37f9d81cc8c0dce224eb
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 12451c14bcbcc6be77d8526d8626c0c455cfaac3e1b4e874febee37874d0894e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 0c40fcd455f5904e2fed9f0339e8679011f25951a00255fa35b8e0fe22de9f11
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cdc21963a29d3ff8ef5d1c01587dfacc0f8318e3100936c2dfdc1936959c7841
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 519eac4f871945aa16d3717b20de8669ffcee757c0ca4d8afff0d7f31cd1a81d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 da70099c47eed71f0dfa432f4f8e885af3d51ce2c324f9a6614dc209fdbade98
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a0bd96173bd266f90051770c3185d4abf3cdc95c410edcf49a0b2886c39d2ea1
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 c338141e2063fcd7a1b434a85ec08587ea85d05b59fca6588a069ef906ecbb61
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2616616997549c1e9d1a4d0bf7c82fa81a4a8bf7652ebaae0efd5d84aff6b58e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 1706c8771ffa04453038587dad571cb0378c13b517387655bd9edacf1553a91d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 4f5f16ff2aba50dddd22d3a1581886635e114eaa346c10b86234fec4ec2780ec
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 a8451ee6cf625df9d6b0c9877f1c85c85b28db4eace9099a8f470d1a530a8fe5
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5e6290c944e21bea9c09835de6923bdd8b6e05c5881bc28d9032109104868a1f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              a80fbf72-2a85-403e-be3a-5b038b03c2a6.tmp
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a80fbf72-2a85-403e-be3a-5b038b03c2a6.tmp
                                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 d13daf83889b8099190cad24e178ee03f660b9d025d14b125ae57d947a9cbc7c
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              9fb601bc-bfa7-4b09-aa3c-b87f0bd6d2c2.tmp
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9fb601bc-bfa7-4b09-aa3c-b87f0bd6d2c2.tmp
                                                                                                                                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 21e64cde7656902a0f41947f5e8d397ed967615ce4add3b85b18af42a6c9f937
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                              • Size 94KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _bz2.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _decimal.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 265KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 64KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _lzma.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 159KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _socket.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_socket.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 78KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _ssl.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 151KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              _uuid.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\_uuid.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              base_library.zip
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\base_library.zip
                                                                                                                                                                                                                                                                                                                                              • Size 711KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                              • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                              • Size 678KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              python39.dll
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\python39.dll
                                                                                                                                                                                                                                                                                                                                              • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              select.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\select.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                                                                              • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI38242\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              d9n7k0.exe
                                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d9n7k0.exe
                                                                                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                              • SHA256 3dffba50c9224d53045baa6ff66826bcbcff25bd21be1193dbb93119f8790929
                                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1038-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1010-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-689-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1008-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1009-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-944-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1030-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1034-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-818-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1041-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1042-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/6132-1049-0x000001C5F0610000-0x000001C5F0A84000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                                                                                              memory/9412-1035-0x00007FFBCA0E0000-0x00007FFBCA554000-memory.dmp
                                                                                                                                                                                                                                                                                                                                              Download