da6d08a4cc434fbc1520a0f2ffb69a817dc5eb15c2457fd97a2e29a4009c2c83

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 5.3MB
Sample260810-phtffshj4t
SHA256 da6d08a4cc434fbc1520a0f2ffb69a817dc5eb15c2457fd97a2e29a4009c2c83
MD5 3134c7b69c5e001c69c4f228dfcc5b80
SHA1 11b4e2fe7d426f2c0e588967ac69763e68ff532b
SHA512 a8de728555bd1480d71a24accaa2ce476fbbf079659733a99ca9a99be5df9c4d05bf2c27046d7f6dc4d357037a02b7dcd824a6d9ab7e26f252afe04642f72da1
SSDEEP 98304:UCgtMcyIICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllRHL5M6L:0MyICteErownP0oTcMsABql3NL
TLSH
T18A463308B3E809E2F6B3D53981565221D573B4254BB0D1CF43AC9B662F677E0AE3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Loads dropped DLL 22 IoCs

pid	Process
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrowserSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrowserSetup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
4832	arp.exe
3116	arp.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_99188562\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1668_1616571243\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4272	cmd.exe
420	cmd.exe
5880	cmd.exe
1712	cmd.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3036	netstat.exe
1336	netstat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1800	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4956	ipconfig.exe
3036	netstat.exe
1228	ipconfig.exe
1336	netstat.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308380956498091"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D6A91EF3-6778-4EC1-A23E-FD94F75BDAF8}	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5832	wmic.exe
5832	wmic.exe
5832	wmic.exe
5832	wmic.exe
5440	wmic.exe
5440	wmic.exe
5440	wmic.exe
5440	wmic.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5832	wmic.exe
Token: SeSecurityPrivilege	5832	wmic.exe
Token: SeTakeOwnershipPrivilege	5832	wmic.exe
Token: SeLoadDriverPrivilege	5832	wmic.exe
Token: SeSystemProfilePrivilege	5832	wmic.exe
Token: SeSystemtimePrivilege	5832	wmic.exe
Token: SeProfSingleProcessPrivilege	5832	wmic.exe
Token: SeIncBasePriorityPrivilege	5832	wmic.exe
Token: SeCreatePagefilePrivilege	5832	wmic.exe
Token: SeBackupPrivilege	5832	wmic.exe
Token: SeRestorePrivilege	5832	wmic.exe
Token: SeShutdownPrivilege	5832	wmic.exe
Token: SeDebugPrivilege	5832	wmic.exe
Token: SeSystemEnvironmentPrivilege	5832	wmic.exe
Token: SeRemoteShutdownPrivilege	5832	wmic.exe
Token: SeUndockPrivilege	5832	wmic.exe
Token: SeManageVolumePrivilege	5832	wmic.exe
Token: 33	5832	wmic.exe
Token: 34	5832	wmic.exe
Token: 35	5832	wmic.exe
Token: 36	5832	wmic.exe
Token: SeIncreaseQuotaPrivilege	5832	wmic.exe
Token: SeSecurityPrivilege	5832	wmic.exe
Token: SeTakeOwnershipPrivilege	5832	wmic.exe
Token: SeLoadDriverPrivilege	5832	wmic.exe
Token: SeSystemProfilePrivilege	5832	wmic.exe
Token: SeSystemtimePrivilege	5832	wmic.exe
Token: SeProfSingleProcessPrivilege	5832	wmic.exe
Token: SeIncBasePriorityPrivilege	5832	wmic.exe
Token: SeCreatePagefilePrivilege	5832	wmic.exe
Token: SeBackupPrivilege	5832	wmic.exe
Token: SeRestorePrivilege	5832	wmic.exe
Token: SeShutdownPrivilege	5832	wmic.exe
Token: SeDebugPrivilege	5832	wmic.exe
Token: SeSystemEnvironmentPrivilege	5832	wmic.exe
Token: SeRemoteShutdownPrivilege	5832	wmic.exe
Token: SeUndockPrivilege	5832	wmic.exe
Token: SeManageVolumePrivilege	5832	wmic.exe
Token: 33	5832	wmic.exe
Token: 34	5832	wmic.exe
Token: 35	5832	wmic.exe
Token: 36	5832	wmic.exe
Token: SeDebugPrivilege	3036	netstat.exe
Token: SeIncreaseQuotaPrivilege	5440	wmic.exe
Token: SeSecurityPrivilege	5440	wmic.exe
Token: SeTakeOwnershipPrivilege	5440	wmic.exe
Token: SeLoadDriverPrivilege	5440	wmic.exe
Token: SeSystemProfilePrivilege	5440	wmic.exe
Token: SeSystemtimePrivilege	5440	wmic.exe
Token: SeProfSingleProcessPrivilege	5440	wmic.exe
Token: SeIncBasePriorityPrivilege	5440	wmic.exe
Token: SeCreatePagefilePrivilege	5440	wmic.exe
Token: SeBackupPrivilege	5440	wmic.exe
Token: SeRestorePrivilege	5440	wmic.exe
Token: SeShutdownPrivilege	5440	wmic.exe
Token: SeDebugPrivilege	5440	wmic.exe
Token: SeSystemEnvironmentPrivilege	5440	wmic.exe
Token: SeRemoteShutdownPrivilege	5440	wmic.exe
Token: SeUndockPrivilege	5440	wmic.exe
Token: SeManageVolumePrivilege	5440	wmic.exe
Token: 33	5440	wmic.exe
Token: 34	5440	wmic.exe
Token: 35	5440	wmic.exe
Token: 36	5440	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4860	1288	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4860 wrote to memory of 1712	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4860 wrote to memory of 4272	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 4860 wrote to memory of 4832	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4860 wrote to memory of 1924	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1924 wrote to memory of 5448	1924	net.exe	99
PID 4860 wrote to memory of 1260	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 4820 wrote to memory of 3428	4820	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 1260 wrote to memory of 408	1260	net.exe	104
PID 4860 wrote to memory of 5832	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 3428 wrote to memory of 420	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 3428 wrote to memory of 5880	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 3428 wrote to memory of 3116	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 4860 wrote to memory of 4956	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 4860 wrote to memory of 3036	4860	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 3428 wrote to memory of 720	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 720 wrote to memory of 1276	720	net.exe	120
PID 3428 wrote to memory of 6044	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 6044 wrote to memory of 4216	6044	net.exe	123
PID 3428 wrote to memory of 5440	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 3428 wrote to memory of 1228	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 3428 wrote to memory of 1336	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 3428 wrote to memory of 1668	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	131
PID 1668 wrote to memory of 5448	1668	msedge.exe	132
PID 1668 wrote to memory of 3024	1668	msedge.exe	134
PID 1668 wrote to memory of 1800	1668	msedge.exe	135
PID 1668 wrote to memory of 3024	1668	msedge.exe	134
PID 1668 wrote to memory of 3024	1668	msedge.exe	134
PID 1668 wrote to memory of 5612	1668	msedge.exe	136
PID 1668 wrote to memory of 5612	1668	msedge.exe	136
PID 1668 wrote to memory of 4616	1668	msedge.exe	137
PID 1668 wrote to memory of 6064	1668	msedge.exe	138
PID 1668 wrote to memory of 4616	1668	msedge.exe	137
PID 1668 wrote to memory of 4616	1668	msedge.exe	137
PID 1668 wrote to memory of 6064	1668	msedge.exe	138
PID 1668 wrote to memory of 6064	1668	msedge.exe	138
PID 1668 wrote to memory of 4056	1668	msedge.exe	140
PID 1668 wrote to memory of 1216	1668	msedge.exe	139
PID 1668 wrote to memory of 4056	1668	msedge.exe	140
PID 1668 wrote to memory of 4056	1668	msedge.exe	140
PID 1668 wrote to memory of 1216	1668	msedge.exe	139
PID 1668 wrote to memory of 1216	1668	msedge.exe	139
PID 3428 wrote to memory of 3416	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 1668 wrote to memory of 5988	1668	msedge.exe	142
PID 1668 wrote to memory of 5988	1668	msedge.exe	142
PID 1668 wrote to memory of 5988	1668	msedge.exe	142
PID 1668 wrote to memory of 1408	1668	msedge.exe	143
PID 1668 wrote to memory of 1408	1668	msedge.exe	143
PID 1668 wrote to memory of 4456	1668	msedge.exe	145
PID 1668 wrote to memory of 4456	1668	msedge.exe	145
PID 1668 wrote to memory of 4456	1668	msedge.exe	145
PID 3428 wrote to memory of 3796	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 1668 wrote to memory of 6080	1668	msedge.exe	147
PID 1668 wrote to memory of 6080	1668	msedge.exe	147
PID 1668 wrote to memory of 6080	1668	msedge.exe	147
PID 1668 wrote to memory of 3540	1668	msedge.exe	148
PID 1668 wrote to memory of 3540	1668	msedge.exe	148
PID 1668 wrote to memory of 3540	1668	msedge.exe	148
PID 1668 wrote to memory of 3580	1668	msedge.exe	149
PID 1668 wrote to memory of 1676	1668	msedge.exe	150
PID 1668 wrote to memory of 3580	1668	msedge.exe	149
PID 1668 wrote to memory of 1676	1668	msedge.exe	150
PID 3428 wrote to memory of 4844	3428	2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	163
PID 1668 wrote to memory of 3068	1668	msedge.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4272
- - C:\Windows\SYSTEM32\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    PID:4832
- - C:\Windows\SYSTEM32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:5448
- - C:\Windows\SYSTEM32\net.exe
    net user /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /domain
      4⤵
      PID:408
- - C:\Windows\System32\Wbem\wmic.exe
    wmic logicaldisk get Name,Size,FreeSpace,FileSystem /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4956
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/gononstopukraine
    3⤵
    PID:584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Go_nonstop_admin
    3⤵
    PID:7496

C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-10_3134c7b69c5e001c69c4f228dfcc5b80_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:5880
- - C:\Windows\SYSTEM32\arp.exe
    arp -a
    3⤵
    - Network Service Discovery
    PID:3116
- - C:\Windows\SYSTEM32\net.exe
    net user
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:1276
- - C:\Windows\SYSTEM32\net.exe
    net user /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /domain
      4⤵
      PID:4216
- - C:\Windows\System32\Wbem\wmic.exe
    wmic logicaldisk get Name,Size,FreeSpace,FileSystem /format:csv
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SYSTEM32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1228
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffef6efc188,0x7ffef6efc194,0x7ffef6efc1a0
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,9307215473337836638,16242112300363386648,262144 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,5036655616230038332,13675017616053599618,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:11
      4⤵
      System Time Discovery
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,12429845853707433289,12868512284802681804,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17924006496410824955,16738728920090874956,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,16744212486836351811,5482774432303374211,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,924437489346025685,5017630813458224263,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,8683320016891284158,6624717662222857767,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5260,i,2306809009249766220,12773487443610431191,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,250180303934225535,10314869524880675069,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5496,i,2940560718712641956,10408512948859077103,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5652,i,14662712554523386119,16870758722481161354,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5588,i,4350380608121430727,5126511894151116597,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,6688086760713900338,10970960157861002337,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,9876174894564015721,16225192726621834360,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6408,i,15448446521428535659,9440841814790454423,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4410407112873312965,5551027848574934477,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,4410407112873312965,5551027848574934477,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6880,i,9764954981813430276,6185163822229316054,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7180,i,10809717383815061728,12675660208210147643,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,15729708277735973554,1251719558479495398,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,11096055693529936914,2622558990299200021,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7920,i,11049433013680288233,13349886841967983731,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7996,i,10979253115276701160,15990809093187876159,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,7935001589579229928,14813632284368205520,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7444,i,17169611148917739298,17389951265649053064,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7544,i,6624957636916507231,10073122526735840769,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8000,i,3580557823102426596,4706460361839248283,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8292,i,15771849705644994776,2660994549801715285,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8428,i,7941584701947124750,3312554542439584993,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:1
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8468,i,13699084394575162512,1323948710156324779,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3720,i,17670860413122840749,1817809155826008674,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:1
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8444,i,11706913707003038516,16049454524507334163,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8408,i,6607871771201310801,6257890515118241746,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:1
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8116,i,12520257194849419514,2218705172086374070,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:7512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7728,i,532863742257907191,17708601761610830243,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9076,i,8098229384152286455,1081251757962764103,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:12
      4⤵
      PID:7724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4944,i,16571871020085031437,371699551479805524,2097152 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:1
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,2618109613387735862,11279226596554442096,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,9071231231959906992,7595049532549451885,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,9381697388927174643,4432645087275598143,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:14
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,456144398525705913,5418391808311340427,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8644,i,17252761576219090605,7128977526668547622,524288 --field-trial-handle=2848,i,8007100317987182832,1941122881743729670,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/gononstopukraine
    3⤵
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Go_nonstop_admin
    3⤵
    PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:7968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Connections Discovery

T1049

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks
Size 3KB
SHA256 37045b2cea90d95f0b47d666b7f4281c60bc23e93261d7c7cb83cbe800a43e43
MD5 d2784fa41e91d8b9396218c341beb677
SHA1 3715ae707dd57b15de1d25218b6d2ba9db88f2b3
SHA512 781db028f650ec36ea3af4c924d24089f655f13ca7211b959f603f785778ad11e1fd456922e813c212f95ef960b29f99b99cf636cb894ceb1513f04da195eaac
TLSH
T19851553BD12BDC5B49B86195D8B08383FD00432FE1424E43753D69DCCFB6A29A748E59
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarks
Size 1KB
SHA256 38e8cd3be2c56655383bb267e82d59f432791bbbc40dbb59a447aa15afeefcf6
MD5 c558c15953703cd1486017ede4a88b15
SHA1 7ada8789f6b4cbec2fc55add59b6bdfcf7eef370
SHA512 4d56c0fee5f74afd9a440844a2b955b42d9b1f1f0e3be9ead2072198d803da2709248c5149eabb2a49bf821379a0d68aa07d51f34e5569b1f4902fdb431778c4
TLSH
T13021547BC92A9C1F58F8A1E0E0314743F800172F91900C033ABD89ACEFFA9515609F9E
MD5 SHA1 SHA512 TLSH

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002d
Size 30KB
SHA256 e9fca7e9968cc9fec3c7058516eb3c77cb9e3d9340cd0b8190571353107106ba
MD5 ff83ac7472e824fed2f102eba2f8d571
SHA1 a203324389f57958969844f1b708c3490ee38828
SHA512 b988a036283888405017509b249022c8f2387de82bbf160677b40a048ed631e508947784c26dec82f8d8698f606cd2d88a99b2bb5cf57ee3ff7a26ecbfe3fef1
SSDEEP 768:Tf4GGSdhfRpcFAO15fzK91tDka/4Q2gDcnxDVHHOE4om:Tf4GjNRprOXKj1kaSgYxNHO8m
TLSH
T114D2F1FBDE76A24288603A4ADD043958DED7C617857227CEEC1D8844D3ED49D0BF920A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00002f
Size 80KB
SHA256 39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd
MD5 14e39be019da848a73da7658165674cb
SHA1 e016473c4189a8cc3dbff754a48b3e42d68af25a
SHA512 828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029
SSDEEP 1536:kAXTJvOGTDbA80pK0Mdq3wUAVa6BGS8EE/c0Psh6lufc4Ap7QgqHM7zxFX3xzOEm:kAXdJDn3QRoag8pcM6fdAOgq4xNu
TLSH
T17A830296752BB1D4592B012A9EC1F20294222F713DE7D02C15EE4F6E27DBD21698CEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 55KB
SHA256 52a37b3a78eb5b59df3bdb129b9115c6fed9bec6ca62b55ae56d8c2701de5972
MD5 fdf2600d905a0faa060d691e0212e1a7
SHA1 62550f0993a219e265ff9a0795a4d9f49b28748f
SHA512 7118d2ea3aafe3d77709842da20acbe3faaf4c6c92a50ab05ecd4986916bbb92fe297a1b00357572683b02c61762cdf31dc425f03221dd169803252db5f04f7f
SSDEEP 1536:HYDhrXLgUVTf98fcANMQnJULOK+z2N2Vr8KO:HYDhrbZTF8ffZaOzM2Vr8z
TLSH
T1804301FE4895FEB9B094C7938D7131E02A664022453CBB71774B13B76368E7682892DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 57KB
SHA256 e4dd3bb15ae6492d5ddff59e08075a6023463b82cfe6c284470fec0d86fe52ae
MD5 26a1891f272dc17f5ac69a8cfde2991d
SHA1 097239d7cb11b964bd6a745f24e5f82267fcaf0f
SHA512 2b78bc3b2e57aeaacdbce5315b117c8900f9cfb99e331704c80f871882b1f0ad88ef7d6808fea6a8e93e1e65a239beaff9c3d61a07191b96bc21c0fac759d783
SSDEEP 768:eEWSWa7VSQrI9kNTF9HFrfpjBooNuDFjy3zW5/7lo6Ks2zQ5oF+mK8UMrrbFHpLY:ElQ8UTJrhjKC6jyT6/8Q2dVxJphFSy2
TLSH
T14D430167125E0EEB16A860EA197B4FEE86DBC57C733C75A700E39630F6354540E178A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 56KB
SHA256 5ac2037030385ad8cf10e486b44475d778eef2e2a377751fbf3c938fd3991b1c
MD5 5e53ed25086aaa0d3337101b741466ae
SHA1 08b6244aa107201b2b4e6e76ce4c123dcacda182
SHA512 7c90e1b48ee9a1dc112bc1921e2a42f4d329d734be246ed488aaead60ff14e2581580e6629bd2b24c109cb66279190df3ee494eb83d1b96f418886cd72f2747a
SSDEEP 1536:FyvVCHVdFlgUZgt9f+rCIAaGrxNkcW3hzT0iBTXe5SLzmG:F6EVOUZu9f2CRzrxv0h0K7ewzmG
TLSH
T18A430207A8501D88A3A512B3304BA39F25FEDD587B744076FBE068F9BD5AF16314D09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efa986235cc38916_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efa986235cc38916_0
Size 6KB
SHA256 c453c10a4729c83c99aa96f7d6e43e87f24bd00b3c7a1896f393e41fabed8947
MD5 e2c4033f561673540358288413effede
SHA1 d30212bdbe459e4731bf23ce3bd84234897abe89
SHA512 a01179d05d8da11cd047ba78bc0b4a794fc0e5601d67728e7996cb61e30c81425757d3dfe6c85d9f7d259e6fd7617d02236f55cd73dfb6eab0202fb3c763daba
SSDEEP 96:THLTHEejPL0zHagnrZ74cgfGQNLb6CI3aaGyzjoOjaNWSPVFVSCeM1zIa7:bhjPL63174caGQhoa4taDjVD1zI
TLSH
T17CD1A7575BAABD3BCE1153F811D25917E23281283BE38E130A90C7313C542E65E1AE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.tiktok.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f78b39773dee476c69f9a929913bd8bc1fb3e88a1c890dcd7eebb9c2a88299c9
MD5 6e0beed1af227baaa371d984a1c0dc15
SHA1 4f8da8f97a4d8a92736d5901dc7442ac5f1c5214
SHA512 335efcee9d2535295917fb97058eb1547b3a370a72f27098547eba3eeec9a091fceeaec2e038cd69e79c4e1e7b128c8762e9838116051885631f6d2e51978301
SSDEEP 192:DwhXF+iC09aVZjhBHZjcCxoHzNQi0qYcbGugVvHkyApv4EvOeSzxbFkw:DwhXF+iC09aVZLHZjcCxoHzN90qYcbGZ
TLSH
T13802ACF783F5862DAD1156F4AB056E2BCF590924432C386A89D5AF2BA7F3470E101B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 67ebbd17c20e820470ccdc6178ee0cc098090718a11e11c627bd889047dbe641
MD5 fe0800de65aafadbf88886893c1094a7
SHA1 0386adab38a586b7767ec9c3571ecc15f9ebef8d
SHA512 2436c2c722cb06ce9e59b9e423ce16ed7fa63fc7d64b9f2b1f497410213d8bf216d0ee42a1ca624909b9d974d8354a6c76df84b7fbb07739974ad1fd0c7fba65
SSDEEP 192:sxRER3EyM/jK1Ml8wCq/fdsa/uMZZ8NP6lzoD8pKZdAF4FXHg6+WNsFbl2SdJOHp:sxREi8q/fdsa/uyHRaR5CZG5/+DSoS
TLSH
T18A720C0AA6385E778DDFD218F951BB63D6F8043295905F48AAFCDE1C10E6BEC610381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 efccfef996ce2598ac6abd180123a08356aee5d0a318b0c864f845672650c9aa
MD5 e731342a2896fb47d3d9430c6c315935
SHA1 8b8af3c28b3eb3a1e6494852332a7577424d394a
SHA512 a07161599f992ae851f3fd1309712eaaae071e27c736479d9a414751ceb60f5b2f14ff8de20d64e7d0f05a43094d6d555e149ca7a1e3751d7ff99ebd18e4aa26
SSDEEP 192:tcFaY0U/32X3V2b5leE2VngTRxP7N98xrt4t0TD3Bq9t:tcFsU/L5lebQj7N9stxG
TLSH
T11842E115D9F44CFF08F5A2697C7C5342E620472B61680D1B77FD8A2C0F33A656186FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 93e4c5a5f2e02f1720b7b082537a8f2fa1a04a2b5d8ea5efa50ac41df816361f
MD5 fa4cef0f9ced5ca27a16d6b2bf269c74
SHA1 57a1f33b2b49eaa927fe830ad5304bfdbfe826c5
SHA512 6d9f7ea0a68d7d906095142b8a4a11867033668699c8e961b73eb633bce72ddc86731c860c79d96074e3c0a6b95d983bffad5c3c2be213602c3c2ed299891f12
SSDEEP 192:sxRfR3EyM/jK1Ml8wCq/fds3/uMZZ8NP6czoD8pK7bFVlMFXHg6+WNslFFHSzZBP:sxRfi8q/fds3/uyH0rR5wk7IfTDSAS
TLSH
T1DA720B4AA6385EB78CDFD118F951BBA7D6F9043291900F94AAFCDE1C10E67EC611381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f9291b8b1fdeb9864e43337033e9f16f1d8d6575cd27ddb93c8f4a05038de1c1
MD5 91544f98f0fd24f9a253bf7bb427ca67
SHA1 d1a1d2752fae86ab1853d27ea41912b0e8b0dd84
SHA512 35d2ec5e67a41a8b651682c00d0d40294fbdbfaffe337e5bb27fc4cc64231430aac37f81f3d06a79dd62d00a0056d482d538637f08e601136d3c7d0954e6a851
SSDEEP 768:j/8vZF7pLuLffQWgQ+fz+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdWTQqq4rovz:j/8vZTEffQWgQ+fz+u1jaOWTVqDL
TLSH
T102E20C7B680CCB7E4F804E9DEC29BD9AADE801CF5698CD5447EA840C03C67EB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\45935866-a2de-431b-a918-f361159ced03\index-dir\the-real-index
Size 72B
SHA256 5606e71bfe11005cd4c7e39ab41ab818ff816e870d78ccd0c935291afdbb932d
MD5 e679b3397af2a8114c5b1b4cd31bcddb
SHA1 013d651cd8021c9a7d42936462e439c5025c9427
SHA512 487e348e80ce8ea0bf463a7272368c1e73342b8843deed89ee8fb024997c564e855562bf5ddb0d6925eb24047d278f6108ccc7c01ad73b4bb0ffd9a41a1df0bc
TLSH
T1FAA00218835D6842C07D87F015452141B6709D9005022B4644E9505D9A672454115554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac43c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\45935866-a2de-431b-a918-f361159ced03\index-dir\the-real-index~RFe5ac43c.TMP
Size 48B
SHA256 e5aa27d84301e4254f07fc99615f943561468377ab105b93d89e2c3076086fb1
MD5 6e3281de6cc925a7557e9596e57d5ead
SHA1 bda7a1db81e6d8f01fd8d9c704ec17a64502b41b
SHA512 321be3def0dc9127e59a96f1ce8e02242b587ddcc71e1d2213bc250e72eae6b1fcd31417b8ea34c924d3492cd3d09fa9d675724251a9927d1b3f0ee629c821f4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 cc29fb10c14c822b2841dae1907e6e4aa9df7343f9482d6d894c380da7670776
MD5 72b942c8d0fbc4df00e7aae955ca7ae5
SHA1 93ae50649498e37b4ab5f62846c250e67d1b892d
SHA512 5a493a4909ddd743c2997479ee4f9da97a22434db1567800ac7cbb03443b8bb583a4d950135462369a444d305120423b309559080ea1e98e3d8faf1c8c6abf23
TLSH
T1B5C08CA70565C140EFF09EC074BA72286E2228CAA89686CAA40211DC0A508A208A6FB7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ac47a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe5ac47a.TMP
Size 165B
SHA256 9670ecbed7b041a82ca01d8315a0949026cc939bed42437021d5fb4b9b1e3f94
MD5 b7024c6f21a584e616c5bad279b5ae7a
SHA1 a668ec878ecfdf65d34fd389d966cb4d32fc5a47
SHA512 46744b1485f9d22bd814a175dd1b2f17ca6d64255d63a6c2c2417e67eeae1c3fffe3bd6768ced920949f33e1223093def2137978ac0b34d598f5c0f6b25c534d
TLSH
T1C3C08CA705758200EFF05EC0B4B8A1286E332CC6A88646CAE44231DC15708620CA9FB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 55769cd8bd4d69e9ee63350ca6f87f7dbf2185a7f15229f36deb10fa8c2c8628
MD5 32009ec928a30e292da13e0b19714731
SHA1 98efa8ffe25af42addb98b9fb5c16a3441683f4a
SHA512 4302595976645e49134ee2074ef75d1604725a4c2b593a82851fed259908af5a1d74f8a130ff66abb91a538e74a10eb3473f8e0f78106a133f5297b6b6b29dbd
TLSH
T143D02208CE058240C92082B8A1A2A0CF6335CAE9C90CB3A8407C71CF3EF20210A82526
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 c24e68a18e1f3e86a0fae6b5f953f275ddd0785354e0908bdb46364f39b446ce
MD5 7343a47ea8d097afef85ef0ba96e7b7c
SHA1 846b5a1b42d50a6d8686377365939db2ec5ece1a
SHA512 9fbbc2a6fec7e8eadf9fca0bb3e6a09c34366d0d54f7dcb55c5ce0e133d4e5bba297a1caeebc240c87f660cb92cb2a835b4c81045fbbecacb9fa2ad7dc3a4d3b
TLSH
T105B024505C073001C44007F0375110513510CF7745053033C470CC55CDD31000FC0500
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 84730d3169fc8ce105f30e0f879b9ad60329bb9412c4c757d9b6cdc1349149e8
MD5 3968caf3a5c321206dcc859aced87f2d
SHA1 215ae94403c8ac5fd92123fde0cf59e174dc7ad1
SHA512 178bd478bfab208968202b50ddf861ffa768cef730a393dfdb9aeb7fee1544e60ebd23331d3ee448a6618af51fddc1310333bc37f961277e82c3e93bcaee4a68
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOH0VAE+imkWivPgMkK4BgGkckEP+k5HxOfq:CbEBVj5JAdSp9/EgTK7j6dJOH0VAE+iU
TLSH
T18C910100723F0285793DB44C80B8896FCAC1B1773419E52B7BA846664F67E439DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed69f75a-f6aa-4383-9900-eb39ab846470.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed69f75a-f6aa-4383-9900-eb39ab846470.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9dc745df4dcfd541c24dad4f5b4d7843902bdb644625ab13209f78d2d20298c8
MD5 52a20b2d2ee931c440dca4d1f50f36ff
SHA1 e2db271db5dc65210cdfb2752fa50a0b20e4ef91
SHA512 6fde30a00e89b6100ccf23b288f5564b4c13af3009eb675aab32e4c6ab027c5942fdee6576df1f47b2fad213230c0faa9a8c39a36f12f2d2fdb3c0f6de168f90
SSDEEP 768:Xc3Qy8N40p8+p3bd66j+4BRv86aLIWkhy6DqM:Xc3A4C8+p3Z6n4y2Tr
TLSH
T191F2AF71E8A99D335CFED644F29637836EF4156395C01ED8E4DDAB1D04832AE270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4a62f4718116dc377ff29a5c6faaee2b3c080c9c0987a21a26fe31885afc1f63
MD5 a7559a0848086701c7eaefab3d4d03a9
SHA1 6eb8527343a270106d48869ce8cd44edd83aeb8c
SHA512 5e551e79634da433cfddaea9d183eb91eebbcff30ae77a01eeb50ab1facb75ee0f854d6a9aab250782c60cae6c841e8e57397c5d6da8718546bea46d9b513e5c
SSDEEP 768:tFQ73twgCRtN+p8+p3bd66j+4BRv86aLIWkhy6DqM:873o48+p3Z6n4y2Tr
TLSH
T19D1317F594E78937D8AE8747A37D2E429EBCC063B5845994B7C85E0CCC821BFD70A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e8db1a08d2b0b89069a28ac4d9b1626d7a05d3ec04304a14f2fa7d2c21ee717a
MD5 51f6d3206947fad1b45c2c3e13a0d73d
SHA1 c36407d477c2e396af6bc513623ae690fc181157
SHA512 5234ac511ba1a0eaaee3c9e58cc2d343827ef6b6775a08251e587e2629384acdddedf5e23221885f9502668d1265a9b5f3615574c425b083e596d2240e090788
SSDEEP 768:Hrv+4UNbdD3r88N4Np8+p3bd66j+4BRv86aLITk2bwCl1:Hbsbp3r4L8+p3Z6n4yN0ww
TLSH
T1C903BE72E46C99339CF6C644B2867B837FF811A395C10ED4E8D92B4E405A29E370B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 85a2a52e0bedf2e0c21e45d7ad9bfea4966c7d1c461ee0f4e208afc258e866de
MD5 b449bb5bfd7c4207fd98260b24d28549
SHA1 0e8c03704b4632a7b43596548ac9a81b6860ca71
SHA512 d24e8c069e51ab1aac70bcb55f041caca13b9cd300769e75ab55e3597041b4f7a17e4d83fe0a51f389fecdd00ef3ee0b8a362f1f913cc3f824ed08fcde0d0723
SSDEEP 768:dc3i28N40p8+p3bd66j+4BRv86aLIWkhy6DqM:dc364C8+p3Z6n4y2Tr
TLSH
T178F2AF71E8B99D335CFAD644F29637835EF4156395C01ED8E4DDAB1D04832AE270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1fa523bbd7f30f57e065428b53b0fa957e07ae6573ae497b52d82235a0676037
MD5 d46e3a7996ca7226a6e4c97b45f9643a
SHA1 a91dc3022884f94b8c92fbab6a24edd16e291cc1
SHA512 56cf385b038871358c4ebc8144fa10c37e57f50067f6de8374ecc43720155b09cd26108742390dff6e2f7351cf6354e6379cb1a1f3e2f87ff56e0dc8ce073192
SSDEEP 768:Hrv+4UNbdD3DK8N40p8+p3bd66j+4BRv86aLIWkR30:Hbsbp3d4C8+p3Z6n4y26
TLSH
T16403BF72E86D9D339CFAC644B1873B837FB811A395C10EA4D8D96B4D458729E270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1bf46f42d10ea368458e2c235260652329ab2489de007e438c88b76ba7f65b47
MD5 a1c0525f6b82fc391270c8bec53bb461
SHA1 acf64fbc7ec8f4bc71e6449ed2fd0240ebf7215e
SHA512 fb009378d47db21bafd157150dcb8b93016e6b96080b5cc6cb232f3cae71752a52d55eda7a0c7d144627a26b5685826da6966f2ec239d44765aaf4677cd8a1a6
SSDEEP 768:Irv+4UNbdD36c8LNp8+p3bd66j+4BRv86aLIiY2bwCl1:Ibsbp3aL8+p3Z6n4yO0ww
TLSH
T1D703CF72E9A899739CF6C644B24677433FF851A396C10AD0D4DD3B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3d18c7f30ed5a7929df4dfcedae76e71e34276c15aee083a621fc83e371b16d4
MD5 598d52783d0b8f33abbb47bef357dfc7
SHA1 a58e28567c4330237449e9a7aa71e67f790ee985
SHA512 9494c531a6c5bc171d6886da2d4d94e524a01cbbb86b2a90bbb8d198e1d6879eb55fc495dc57b446ae330e1596b376a5359a6898171894ab4de75b55a34dba4e
SSDEEP 768:zrv+4UNbdD3bq8N40p8+p3bd66j+4BRv86aLIWkR3B:zbsbp3l4C8+p3Z6n4y2D
TLSH
T10503AE72E86D9D338CF6C644B1863B837FB811A395C10EA4D8D96B4D459729E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ca333b7cb552d761dd1e90572343a64c71ea38c063b880b5c885b2d0e3119cf5
MD5 71edb66b8050d528844e0a789df41ec5
SHA1 e1d03b548bdfa231749bd1d622f056690b2299d7
SHA512 22d52493808554b71c7e7a6debaade1ce45af7df5eb6606422349e17fcae3a363d611aa43451843d626dd2de51da42867d6412d8b5161d9fe589dacca7bc04c7
SSDEEP 768:zrv+4UNbdD3Bu8N40p8+p3bd66j+4BRv86aLIWk2bwClP:zbsbp3D4C8+p3Z6n4y20w6
TLSH
T1C013BF72E8689D339CFAC644B2867B837FB811A395C10E94D8D96B4E405629E370FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cd1b303340f0fb09924636793d8b45b279683d2bfda7108031a507b9988da44d
MD5 9dbc4f4f2e2d985b18776359392a519d
SHA1 7724ba8988eb79c1835059c0c5b9ff6a06d02f25
SHA512 5079f50e1ab760b6e8dbecd26549033033be305673dcb5a8f8785fe9aa84faa5dccbf2df5953ce81046a61053ebfd0181df49c4da2b5bbacbf9ae79d91978b3e
TLSH
T10CE00113E34004FBC45C0B31059317207BB3D83403DA0707DE640564BC2871C2E70C20
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a4d27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4d27.TMP
Size 392B
SHA256 0a4ef726a18d69497f3e25053eb785c4ec71338daa829214f41c1ca2cc030885
MD5 7b23248824dd8c835e13c3b161b73b8c
SHA1 19501667429c7bc28e1ecc8d9eb4482a4eecf584
SHA512 8c9a211a4a76814827f6383f729f5626da51c90c2576e0397268c013aa0d7a82943c1ed89562638056ec27c1ee2d244773f063695acccf4bb0502ba1a5b381d0
TLSH
T1B9E00113E34004FAC45C0A31059317206BA3D83403DA0707DE640564BC2871C2E70C10
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3159ecdc-13dc-463a-8003-861ec9bd30a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\3159ecdc-13dc-463a-8003-861ec9bd30a2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\base_library.zip
Size 711KB
SHA256 b1b89e4520ff07cc633f354917f6a9706a86223f7319917f7f53357d43d4bf73
MD5 4e5d1a4110a73beb5ed7e7c9468fcad1
SHA1 9c759a691ec1d03b4d2879eb3e780a5ad87fd3ca
SHA512 2a8c669c5fe234c313f17dad64aa4c3af1bacb287b6f43087d4dcc556555ab3716e8f8d3ff410007013cb0865f867be34353d98f004756c1b78a4ff86c4fd5d1
SSDEEP 12288:60V0cqfyEg2osQNRs54PK4I1IoQDSGdildk1nhyP4axUic:pV0cqfyEg2osQNRs54PK4I1IoQDSGdi0
TLSH
T12EF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12882\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1668_1009756156\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.log

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browser.log
Size 128B
SHA256 3288197953613126fa8b2e70c56520e2cec9109ab37ae48db1e9aa48309bc810
MD5 d832804566b73b4b98166de589905491
SHA1 7be99dc1b88388035d3f09f49d90aa2200763e4b
SHA512 33db721ad97ab1ee99abab07dcc52014e098e7de3d259a00e76085adbb20f4ac41fc307f15e1ed6ae346735793d8ef2ad0e78ac0dcf1834c1f7dc9387cb2235c
TLSH
T1BEB092CB9CBE35109B861B4A6048592B96B03A35C43D1E4063C218AA4C44F0C8EECA34
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Network_Cookies
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Chrome\Default\Web Data
Size 138KB
SHA256 f02d21bc04af97d86c8d1d3849061cb55a03473099b5580aa72b237a245049f3
MD5 a97da95ef79dff7be4a0663616ea1ad4
SHA1 caefd602ee83089faa61d012465b789d1fd019f3
SHA512 f49a37d160dbecb1455db3a96341bd500ead73c40c9263c62c119c860350d38bf1b3d655138114db210224eb4cdca9b2a1bef82957211a082d611dadc33b6578
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQKSPkVum8nX:FnbZeMrv/hGtQKenX
TLSH
T195D3864B3A747002EDE59A721CE050BF5E3C716D8F5595D428B620688EF2863B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Login Data
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network_Cookies

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Network_Cookies
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Roaming\desktop-sender\browsers\Edge\Default\Web Data
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urls.json

Path C:\Users\Admin\AppData\Roaming\desktop-sender\urls.json
Size 631B
SHA256 17851b209a815a2d03179a9da9226fd14379e4b6e41822eadef2a5ce2f6df2a7
MD5 f645e4d635d504dab8636b4f92b65d10
SHA1 1d841b44faaa3ded222137f3574d2f1658689d02
SHA512 e7240cd50577889e39eafaec013ea0f6a80189b841695334ea71b9b50059db8d0a399ff58a1e6b06d28046a02643e1a3fc8887b732debdd8a86eff98b30cdd65
TLSH
T11AF03CAB821094285FB9E5D8F478F358FE43165FBDF2EA43B179470D6B700B14C4881A
MD5 SHA1 SHA512 TLSH

Submit Download

urls.txt

Path C:\Users\Admin\AppData\Roaming\desktop-sender\urls.txt
Size 267B
SHA256 087bb1a900067c0178478760170f51737d229233ee09d08a127832f3358f829f
MD5 64ffd2ca6f3ac9502a99db6fde35d135
SHA1 c66bf8f6dd0031045b616b7f7d2b6c2b9dde102c
SHA512 23ded3dd17af106b37a17f198317260c1ff5d986fb57d1d0c2ccd49adabdc8ed217dcc3a95ecf46e4f426a93d884960fec646eea59ced399ba429a591755601f
TLSH
T1B5D05B7B051D51584FB7D7C8E839B278CD93101D7CE9F74DA0495B4414501316C6845E
MD5 SHA1 SHA512 TLSH

Submit Download