9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63

Analysis

max time kernel
6s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
Size 5.4MB
Sample260817-sd2stadj4w
SHA256 9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63
MD5 3beb58440a523ccbe2661b46fd734894
SHA1 368cfeeabf7d56c69a0f9a8249e790b507bf5d2f
SHA512 3aead9ed23cd893da33b759a36c23195cf5327511c9fcd526b6a44434e1b530f4caad50af14f1328007fc1425ff6ff8197ead0d4d713eee0569996e11ea4dafa
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrB:k7ICteErownP0oTcMsABqlkgczV
TLSH
T120463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y1yq8v.exe	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y1yq8v.exe	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe

Executes dropped EXE 2 IoCs

pid	Process
1016	cs3ybq34.exe
3392	cs3ybq34.exe

Loads dropped DLL 22 IoCs

pid	Process
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe
3392	cs3ybq34.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\fgcfyh8i\\cs3ybq34.exe"	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
536	ifconfig.me
816	ifconfig.me
1342	ifconfig.me
2084	ifconfig.me
431	ifconfig.me
520	ifconfig.me
836	ifconfig.me
157	ifconfig.me
177	ifconfig.me
295	ifconfig.me
429	ifconfig.me
472	ifconfig.me
1817	ifconfig.me
2132	ifconfig.me
719	ifconfig.me
872	ifconfig.me
1013	ifconfig.me
422	ifconfig.me
457	ifconfig.me
478	ifconfig.me
753	ifconfig.me
1041	ifconfig.me
1883	ifconfig.me
188	ifconfig.me
340	ifconfig.me
1425	ifconfig.me
1576	ifconfig.me
42	ifconfig.me
91	ifconfig.me
969	ifconfig.me
1012	ifconfig.me
1904	ifconfig.me
2014	ifconfig.me
2126	ifconfig.me
442	ifconfig.me
238	ifconfig.me
549	ifconfig.me
665	ifconfig.me
752	ifconfig.me
970	ifconfig.me
1280	ifconfig.me
1680	ifconfig.me
226	ifconfig.me
285	ifconfig.me
331	ifconfig.me
847	ifconfig.me
1954	ifconfig.me
199	ifconfig.me
314	ifconfig.me
521	ifconfig.me
535	ifconfig.me
697	ifconfig.me
1179	ifconfig.me
1907	ifconfig.me
943	ifconfig.me
1066	ifconfig.me
851	ifconfig.me
360	ifconfig.me
372	ifconfig.me
1113	ifconfig.me
1190	ifconfig.me
147	ifconfig.me
240	ifconfig.me
352	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4108	cmd.exe
5204	cmd.exe
5320	cmd.exe
6996	cmd.exe
7004	cmd.exe
884	cmd.exe
2924	cmd.exe
6012	cmd.exe
6596	cmd.exe
936	cmd.exe
6520	cmd.exe
3452	cmd.exe
5272	cmd.exe
7308	cmd.exe
5252	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1980	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	msedge.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 1500	3720	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	86
PID 1500 wrote to memory of 884	1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	87
PID 884 wrote to memory of 5048	884	cmd.exe	89
PID 1500 wrote to memory of 4616	1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	92
PID 1016 wrote to memory of 3392	1016	cs3ybq34.exe	93
PID 4616 wrote to memory of 2420	4616	msedge.exe	94
PID 3392 wrote to memory of 2924	3392	cs3ybq34.exe	95
PID 1500 wrote to memory of 3160	1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	97
PID 1500 wrote to memory of 2288	1500	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	98
PID 4616 wrote to memory of 1980	4616	msedge.exe	99
PID 2924 wrote to memory of 1600	2924	cmd.exe	235
PID 4616 wrote to memory of 1836	4616	msedge.exe	100
PID 4616 wrote to memory of 1836	4616	msedge.exe	100
PID 4616 wrote to memory of 1836	4616	msedge.exe	100

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1600	attrib.exe
3564	attrib.exe
6692	attrib.exe
1304	attrib.exe
3788	attrib.exe
5156	attrib.exe
3336	attrib.exe
5796	attrib.exe
3112	attrib.exe
7092	attrib.exe
6352	attrib.exe
6968	attrib.exe
5048	attrib.exe
7468	attrib.exe
8152	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
"C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe"
      4⤵
      Views/modifies file attributes
      PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff9db68c188,0x7ff9db68c194,0x7ff9db68c1a0
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,5839405760097031488,4450274854395570234,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      System Time Discovery
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6739213910910727548,8771137042887542101,262144 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,6478480514917080741,5882851311527153943,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,18078050807819065209,4965136895026582543,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,3386622559371327254,610260803223724927,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,611710892652365433,4554800439200840033,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,3779662005576444853,12805244975626087555,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4460,i,17693483383156361684,14858983799472895525,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4924,i,465662117995195478,7181588667646947560,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5084,i,1548515226832334602,2504310718960584952,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,14374375043721227478,2741145097678235324,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5780,i,3124790263162414639,17072259560974519450,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6000,i,9918847712030163240,14627864611455391934,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5556,i,17270114843049627687,17575563568414860822,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,10526087832218515608,18015313295017647318,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13716305533534797495,9701985823564127341,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,7309455246419625921,16035156448735734390,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7080,i,8170405986224127848,4747313225203903204,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6248,i,10878199063025772706,8336210492287218008,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7440,i,13554949468232664222,17153991499245913338,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5548,i,16708571497986197004,1335355038545022701,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7596,i,18312959081731276805,7251448438006967259,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7936,i,6053874781335881464,11465182704677576779,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8076,i,9166988184562471920,11387888857285262208,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8308,i,6595013514525597925,3053554273246239672,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8468,i,12966168953077364393,16037585982909811064,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8616,i,5612414086911493796,1817979445940775785,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8632,i,6887916006919538058,12288795904746650895,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8760,i,5338624833708073431,3936196683788407097,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:1
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8984,i,7043646928285962374,14032292846434246254,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9108,i,7967093674932792297,4191334192216050119,2097152 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
      4⤵
      PID:380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,15032913083375492646,5034257461089557063,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,15032913083375492646,5034257461089557063,524288 --field-trial-handle=2224,i,4468291408581629653,16389846254804147270,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
      4⤵
      PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:716

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe"
      4⤵
      Views/modifies file attributes
      PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2632

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe
1⤵
PID:1424
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z56bo5yu\mn0j74x5.exe
  2⤵
  PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4108
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe"
      4⤵
      Views/modifies file attributes
      PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:796

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe
1⤵
PID:5804
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i2mi540j\qk43pxjv.exe
  2⤵
  PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5204
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe"
      4⤵
      Views/modifies file attributes
      PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4068

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe
1⤵
PID:576
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9v7q0gqm\ddorkq3z.exe
  2⤵
  PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6012
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe"
      4⤵
      Views/modifies file attributes
      PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1068

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe
1⤵
PID:4440
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tmasbaou\3v2elhsu.exe
  2⤵
  PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5320
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe"
      4⤵
      Views/modifies file attributes
      PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6468

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe
1⤵
PID:6368
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ljpqpgth\dg6d3pb2.exe
  2⤵
  PID:6540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6596
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe"
      4⤵
      Views/modifies file attributes
      PID:6692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7124

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe
1⤵
PID:6848
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ddk7ih1\icovv1vu.exe
  2⤵
  PID:6944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6996
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe"
      4⤵
      Views/modifies file attributes
      PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6472

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe
1⤵
PID:6276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\diov7fp5\9h33rra0.exe
  2⤵
  PID:6376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6520
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe"
      4⤵
      Views/modifies file attributes
      PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe
1⤵
PID:6648
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\16n777ef\btvo3fnz.exe
  2⤵
  PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7004
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe"
      4⤵
      Views/modifies file attributes
      PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6572

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe
1⤵
PID:6984
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nq1xp7zo\74nbl2fc.exe
  2⤵
  PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:936
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe"
      4⤵
      Views/modifies file attributes
      PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6528

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe
1⤵
PID:6332
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e9by862s\mmyczksm.exe
  2⤵
  PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3452
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe"
      4⤵
      Views/modifies file attributes
      PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7036

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe
1⤵
PID:2040
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pqq1gzjf\3yiop54p.exe
  2⤵
  PID:6980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5272
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe"
      4⤵
      Views/modifies file attributes
      PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7248

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe
1⤵
PID:6968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9c539n9r\e60r65u1.exe
  2⤵
  PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7308
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe"
      4⤵
      Views/modifies file attributes
      PID:7468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8484

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe
1⤵
PID:8088
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pg22kfau\nwxfovgh.exe
  2⤵
  PID:8160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ef5vx2yi\xmqkx064.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5252
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ef5vx2yi\xmqkx064.exe"
      4⤵
      Views/modifies file attributes
      PID:8152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 280KB
SHA256 116caf093749c2e465d1de3576c079ebcf73cdd51283000054e82218cde88569
MD5 cadeb452f59265a41c0faa94b574fc53
SHA1 701cb7cc4374f0e6b766ae145c16d12e2b229a86
SHA512 69f242eb2ebe3ee8387795d02f5f1ea4e586431949fff3bc3423f0bf7e1e27c6704e364c5b80c499275118951d3bc8fc01ffc676d7ec25bbc54627df5a78b531
SSDEEP 6144:zZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMolQKdKX:14MSb7e+BnnPVEOiDy0yjH6X
TLSH
T17C54229610CBBF7AFC380E7D1CDF82A551327658579C8EC0E52A061846BEE98E3C6971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 86KB
SHA256 9bfb7d3891dc41283c1701df9de564a49147cb22fc33b466db734f2f79cc0d32
MD5 377e08789ff2ef14350f8047fda3889b
SHA1 708dc2dff51b96a08b46f0895faf6ee06857b0d2
SHA512 909ab18680af0d38758598161d4ca95ed2e5ba4a098a9031b1f84d4051a51f34c7d3e8d3ccf885e0e454635b2691711d9a406ad9acfde55dcb033e03d68981ca
SSDEEP 1536:vWKxFg7/5QIHoKQVfaUX4EnrSCn7uX9eaADgv9FT/QX+lJdU5PsQv3iWMYSkJsYV:vXomVfaUXrdG9CcVFTQOc53uLHYlDks
TLSH
T1A89312A264CF75FE20F516AFF1911C2F354433A327FB42604AA60D8B4B4D27ED620768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 280KB
SHA256 c01b1d80e64d36c37014cbedc15ccdcf20e826e07cfdaa2094c6d4e470d2c3b4
MD5 e41b573b17e43967fe3e55c14d5dfe85
SHA1 459afe1e3faf34a5a4698bfb602961f1f296ead7
SHA512 f769ac941ae6ba94b361a03c8c3796f3b811d5a0e4c2aacfc23ebc1ee767daf6d5fadbae4c4d27928d59f5daaa5daee91358b0caf9469e1438ee2786e8a46741
SSDEEP 6144:amiJ2UKW82ExgTbtMXV5WlYdI/CsUcBrRmlwrqfQ+XealtgaO:aALWqxGyV5WlOI2cXmlwG4oeagR
TLSH
T12D5423720D90C077A60628E96F8426B0F119E6C17C52D8DAF1EBD4D035ABCD7E678B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 140a86924c14da00fc1a4a33381ee21b0d534eb45931b4f9669c79f7490c5003
MD5 8f683c5a2c71bd2d6705751b652ac9e7
SHA1 b9d08109fd9daea3aa728e8ac66dee3183ba1582
SHA512 d0323a139aec75d326eedb1cdcb56b55dbe915ec91b0f82a533bafaded1aa243b99d69d35bda7af810f9710dfe89c85d40b1ebc7c644d3e2d2b489227b5b0bf1
SSDEEP 192:sxZmREyM/jK1Ml8MjA/fOsAVjbEdpL6tJFi/W6+WN0jIZYBDaYyIgyJ:sxZma7A/fOsAVjY0qbnZPO
TLSH
T15A52F912AB3469778DDBD209F951BB53E7F50573A6900E84AAFCD91C00E2AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 801b16d8a6c51174f383e8e8cf443c94fea058a840f40ec4e882d0f1cd5d037c
MD5 95da6c973511ce417e33cc76ec2b508e
SHA1 0f708a887aebb042d3790f63d465a18ea0cc92dd
SHA512 e2c447692cc989f729e114b03a36575573486cd43428d046bf1993257191e1bb10dd69dcb23c4d6e1702cabc32f556501196800a9442520d90d98da4c4f29872
SSDEEP 768:HLs6pY1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNILlWwJNUroYi:HLs6pY1WvxzWju1jaeILIsN/Yi
TLSH
T1E5E20B3B680CCB7E4F841E5CEC2A6F967DD801CBAB94899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 092ef9941c463ee050e9a66abc20a3ac13a6d99c36614998e0011efa3aaea3fc
MD5 1ce33f02e79602e1da4578887869c7c9
SHA1 8a9149f60a0260bf2e0e4ef092478d85ac680aad
SHA512 11744233c541dc3f691f53e1594742da13aee4ad3f854803e62f0ef00d7b52016bb14f2fa3582f7586725f04ffdc7d60830c2ff9379f28d0fd8372298c21bd66
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6f:iiRlHWr3k
TLSH
T1EDE1170231BF06123DBE6B189255877B4B92B663301DA42B7BE940714D6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 58f0f96e42147723caee9c2b86bdadb4ef11024a082eb9eb651a01a1f712ecdf
MD5 f291280bc6466b567d780783f00d8e6b
SHA1 bc3b4eb3ef854b0637b638cd17ad2d668a2e67f8
SHA512 41b770542bcc1f2ed0826373ff7db06a046dce1876394a519d0caedd3ac4746cb1736e69e5466639b2c5852efb4e4a593acdaeb3c1f6b53f41be0011617500f7
SSDEEP 192:zlsNPnQn0Uo/7+3vJtlQmiU1FiWKOatb0sO2b/H5EucMzqgQrJ:zlsNPnCo8LDqW7a9xOsHeKQl
TLSH
T1FD4228346878AC7359E6A546FA8B36539FB910BBD8861F81E8E95F1C00C739C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 581dbb53183c4c6af5c6e7489cd30b48466fa0954a288ad553fd650328e3c674
MD5 caa2e361e625d7d632ff0ca6129a0d3b
SHA1 644ecd1075a60dad24763322a01eb9a7947cdecf
SHA512 15bb3189d4ad26dd2a231c9c29c6b221b2dc49e13c522302ec73a58bb7c43c99352040bcb297f20d4086ace9264f5a6b39e1706a200ce4fd339e18a5698ab5bf
SSDEEP 192:uuLPsNPnQn0Uo/7+3vJtQmiU1xiWqTatb0sO2b/H5EuLMzqgQrJ:nTsNPnCo8VeWoa9xOsHeXQl
TLSH
T10B4229356878AC7359E6A546FA8B36539FB410BB98861F81E5E95F1C00CB39C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55b1f4194a5ea27a4bdd74b8376651220508bacce83d67e181b52a643b3f5273
MD5 0a24ca4a357d220a85b422a06d4836fc
SHA1 889d5d10c949789ea4ee02bcbcd77e040e052f69
SHA512 4674570c9686add8afaaae72bf3a76e468193e2e7ed8b089ec6682b45e48ec0a84c69c4be50ed7aa3d1b56934ba1a943ecfc40abc9411f751f3575c03327d1c3
SSDEEP 192:qONQ6O7+3hQmiUyMoGttb0sO2b/WgG4rU6:qONQ61kGt9xOsIuU6
TLSH
T1C402E83578286CB78EB2AD45F68727279FA5117BE9952F40DAE81E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 250b705f899701569b856525100bae3d0d6236979814f82c7428db9da018965f
MD5 7d5dc42ec54d11f8aad4e82681ff3573
SHA1 5a9f472780020dfe53d0e27344e813f74145a266
SHA512 c1933a16b75904b2905c99470e582191540d24bebee8ea1c26f5108f141db957f8272601721be9c36a52fd6ccc1d67ea8dac712025729d6ddd4ed9b691e12b33
SSDEEP 192:zqsNPnQn0Uo/7+3vJMQmiU1ZiW11atb0sO2b/H5EucMzqgQrJ:zqsNPnCo8eyWPa9xOsHeKQl
TLSH
T10B4228346878AC7359E6A546FA8B36539FB910BBD8861F81E8E95F1C00D739C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8dca0320913cf3ee090bfc00544ef12d2c225a3b26d59d75d64d83049e78a73d
MD5 4564d08c9947ab3053711963b49c84bc
SHA1 47e67a77c0fb5701cc995fae9f4f1f5d06f6830f
SHA512 db4e3c467b5058112a4661bb80d0261afc773ace6e79c12b7d86d1e06fe650f8905727266f0d3702cdd792049a21f739857868a745f5d4dca8cda18c79e6142f
SSDEEP 192:zqsNPnQn0Uo/7+3vJhQmiU1aiWogatb0sO2b/H5EucMzqgQrJ:zqsNPnCo8V1WPa9xOsHeKQl
TLSH
T1724228357838AC7359E6A546FA8B36539FB811BBD8861F81E8E95F0C00C729C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 fdf5d700d84bc5a046bd967bf01a660ba468b964fee2865a2c440820dd880db3
MD5 67894a3fe47837e6dbd27caec81e0b96
SHA1 5937a5a4bc8f70c2c753ebfc27f20f315439fdfc
SHA512 bd010756c8c9cad0d44a475e508ca26c9bfe1e7de4e5971caa064ace1cc4d178ad178f38c8223b6c6c8dfede8cb3e8180543c0d188d2be08aa01fdeaddccc3d1
SSDEEP 192:zLYsNPnQn0Uo/7+3vJnQmiU1QiWi2atb0sO2b/H5EucMzqgQrJ:zssNPnCo8r3Wxa9xOsHeKQl
TLSH
T1BF4218356878AC7359E6E546FA8B36539FB910BBD8861F81E8E95F1C00C729C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cae2dfc2dec8168eec764e5184dcb481f079d82f3b678aee18e3fcf06a8e763e
MD5 50342ac04ef36c831d209999b1625531
SHA1 8e00c14581032f68d04a2b1379053ed5d74a43e4
SHA512 e2cf931a3e3954befe27d81f51c2b8a7b8444b85396749c3d18c0468293ad961379d9a92f78edffb9cd49443063ae9a17dc09f02efcd711461656496c3342847
SSDEEP 192:zLYsNPnQn0Uo/7+3vJOQmiU1riWDOatb0sO2b/H5EuLMzqgQrJ:zssNPnCo8MgWya9xOsHeXQl
TLSH
T10F4229346878AC7359E6E546FA8B36539FB811BB98861F81E9E95F0C00C739C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 932e6d5298c0ab91dc4fb49ac0038ca9f66bab8abf806122b0d79c14de8e1bbe
MD5 217ee228bc657803ac28a1934ed1b9d4
SHA1 59ac30a069e36917b54fa6e9e0b4811b881ffd71
SHA512 ad4a6e6bb55346c77e528c16b7c3f83b1b7fa98490da13363acbc4be4eaaa93e3b2f234f17ce56222475500318116643c0c8e464726c3095599d65e619074dce
SSDEEP 192:zL2sNPnQn0Uo/7+3vJcQmiU1ciWSbatb0sO2b/H5EuLMzqgQrJ:zKsNPnCo86/WYa9xOsHeXQl
TLSH
T1B24229346878AC7359E6E546FA8B36539FB910BB98861F81E5E99F1C00C739C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 16d7aff270c7874c6fc553d6e1603aeb5ea1c95e024dbf1faadaee8e75b3d252
MD5 12d577e742df47528d1b07f97cb6e533
SHA1 3b595fd33857278790379e1d8e9b3132af03f6b9
SHA512 07e8de986a49ee9a1190aa435b60d65bf7c18bc6b54589c32423aebc367321be394fbaff8f64dd7dadea5c20c4e38c30a6f3229ba111b08762966ac4e7b7c0b1
SSDEEP 192:uuL5sNPnQn0Uo/7+3vJ3QmiU1diWVkatb0sO2b/H5EuLMzqgQrJ:ndsNPnCo8vuWea9xOsHeXQl
TLSH
T1954229346878AC7359E6A546FA8B36539FB811BB98861F81E5E95F1C00CB39C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c00d520675f7a0ea3f0b7007ee37eb91b91b15f59c67aaa20f7213c950900e8d
MD5 b389411a344d1a64ff103905a2499eac
SHA1 05a9188cddd5b1844a01bafcf99116a5e73f2b3e
SHA512 56fd9454b01da0d78f047cd6dd7ec511afcd5f11cbdc64e9d5ece26012eea46582c6552740d9dc5ee92e2ac6da50ac30e46c52341417733bf7ea1eeece0923ec
SSDEEP 192:zlsNPnQn0Uo/7+3vJhQmiU1HiWHratb0sO2b/H5EucMzqgQrJ:zlsNPnCo8VgWLa9xOsHeKQl
TLSH
T18B4228346878AC7359E6A546FA8B36539FB910BBD8861F81E8E95F0C00D779C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 493802051e24f070688025e85c205c8d51646b26545eb47d663ee2ada2c4bac3
MD5 bec4b5cbc05d7277d4c1ef7ab3626c2f
SHA1 d66a050d28cd2b3b2331352495f89c9ba80725b2
SHA512 d0450eff7d9d3f5c9be3a7f260b2755552f383d78af430538baa91fb59dd635bfcb1aa18e5388c77ea0de7c7aa0929ba7ee209276463d53ba83eca98d24536f3
SSDEEP 192:zLMsNPnQn0Uo/7+3vJnQmiU1PiW3ratb0sO2b/H5EucMzqgQrJ:zosNPnCo8zUWba9xOsHeKQl
TLSH
T1AE4218356838AC7359E6E546FA8B36539FB910BB98861F81E8E95F1C00D729C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee51ad44ff25bd932edfe723d855d2f083f75c3bc68093228cfc63e94f3ace49
MD5 cedddf9bc471f03c02d64506eaded241
SHA1 d5b6583254343e1126c3db0ece666d05647ea1f2
SHA512 8638414cea4f883de12d7dc311cc3c4a5caafb810b54e4323b21843ebb49e9f71af931515f3177a4299baf74a355c1ed5d57ecbe33b3a708a4aaab481b7d0e0d
SSDEEP 192:zLXsNPnQn0Uo/7+3vJcQmiU1aiWExatb0sO2b/H5EuLMzqgQrJ:zzsNPnCo86FWoa9xOsHeXQl
TLSH
T14D4229356878AC7359E6E546FA8B36539FB810BB98861F81E5E95F1C00C729C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 28e599f55c5e03a3a853b22720df97a971d3f16d6bc0cc60f897bceb4a21b8a4
MD5 6b6f84d8fb84b3973c1ded9e8cc70e4a
SHA1 b02f03b03fcc5d7a36e9e28f3157755bfde73f94
SHA512 a8ec4c79ded003d74a5426811b7639fc7475a40d3886b43c3a5608fb0b02a7a460e003c7ff6da82cfd0eec39abf07cb8d9d93dac119b121df74c532b3fc2f5e0
SSDEEP 192:uuLPsNPnQn0Uo/7+3vJ3QmiU1ziWnKatb0sO2b/H5EuLMzqgQrJ:nTsNPnCo8vkWKa9xOsHeXQl
TLSH
T1034229346878AC7359E6E546FA8B36539FB411BB98861F81E5E95F1C00CB39C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a798ccce5c37c6cc7de930044ba646061b0e8c3cd9cd7df62381168705c2ebf2
MD5 6f9467b689cc705c7c98bbc13b03fed4
SHA1 e08d3382e8a0dc3664876b2b80603bb041ef493b
SHA512 1aaddd933c00ac1edba23624f1d164ec7ec1d571b6e3815034032b8c0eac2d5461ef72bc6a0235a4ed0b8be8da851e7d889d3c71a8d1a38343f3b62408656c87
SSDEEP 192:zxONP6O7+3vJgQmiU1ziWT/atb0sO2b/H5ELcMzqgQU8:zxONP692UWza9xOsHeNQU8
TLSH
T1352208356828AC774DE6F145FA8B36638FA510BBDC462F81E9E95E1C00D729C274BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1889e88e2a43c834b43665fde76e802dc073c4b0f987c13ab7f316a0a6873f62
MD5 619f10e1bfda5e08a3e86b0697ae6bfb
SHA1 1f9420d4f1944ea890c06764d8336fb548b70006
SHA512 5f3c6134349b12524ba72f0cdabf921080ef834689cd388208be22d51a78b9a7feb38446f79b39afabc681d99b12f5106a44e1ef1bc4ad4b397d28eff3cbd092
SSDEEP 192:zLMsNPnQn0Uo/7+3vJtlQmiU1kiWGyatb0sO2b/H5EucMzqgQrJ:zosNPnCo8LDrWha9xOsHeKQl
TLSH
T12D4218356838AC7359E6E546FA8B36539FB910BBD8861F81E8E95F1C00D739C234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 699bb8d7e3a80d6ed677f38bb8db825445cbdf521f034786a1824f402e326feb
MD5 80f793c91acf506ad18e1f61e28dd26f
SHA1 e68551977807386073786c71ad69c6276026dab4
SHA512 322170fda4c7bb0610f42c40f9b04c0cae619a7cf679866d3c0f776601f11bca5957b11a9007010d376b6e44eadd1e5e0818977a9a9effe913afccf220e85d80
SSDEEP 192:zLXsNPnQn0Uo/7+3vJOQmiU1HiWz+atb0sO2b/H5EuLMzqgQrJ:zzsNPnCo8MwWKa9xOsHeXQl
TLSH
T11B4229346878AC7359E6E546FA8B36539FB910BB98861F81E5E95F0C00C729C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 fd1d185ec831d64a24f3fe611eb065026e25b73a26aecf6970abee78187861ec
MD5 e9fd2a23c34228abc5ecf53ffa73df7a
SHA1 1755be287124f3c20630cc9da34ff6039522e93d
SHA512 d432b6a5e19d0ebc3322be9cc37cf19735b05cdbea7e06dea922c1a0e10b0dcb9063ab438fa174c14892c0f1d089321d71a064b9aadf4b96baa209cbd8df2ec3
SSDEEP 192:zxONP6O7+3vJgQmiU11iWBZatb0sO2b/H5ELcMzqgQU8:zxONP692mWfa9xOsHeNQU8
TLSH
T18E2208356828AC774DE6E145FA8B36638FA510BBDC462F81E9E95E1C00D729C278BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 636a2d312033222e35771408880127d4a6fa6047cd11256e077205619b1f6232
MD5 b8c86b7a3118e88658426c4a086c9c0f
SHA1 fbd09f828aed77e883880deb2e15a269c0f7f434
SHA512 47dc5686dba0a4e70fdecca62412e3b4a58797bdb2f4f88267af56dd01d6a32114294dffb04353022eb498f90998fbe37f3a0df5bd10f631a09b80da51f707bc
SSDEEP 192:zxONP6O7+3vJgQmiU1miWP8Uatb0sO2b/H5ELcMzqgQU8:zxONP692ZWPHa9xOsHeNQU8
TLSH
T1072208356828AC774DE6F145FA8B36638FA510BBDC462F81E9E95E1C00D729C274BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a7c3d1fb1baf8ce315a3ed546cd224893917290afe9ec584f293f394231912e3
MD5 f18a93a2d9e5684f99343433185be2a0
SHA1 46950095b5e7eb25df63ecf61cf21e91603c4f61
SHA512 4eaf11ffe3f94f5120c29f411999355b842f48cf9b4730119a918ec6fef5c31ef5e8bec97c57147d4fd5cf3dc8d2c3d614480d066b996cffe7f527d19380df6f
SSDEEP 192:lONS6O7+31QmiUyEoJttb0sO2b/H5ELcNzqgQU6:lONS6VGJt9xOsHewQU6
TLSH
T1D0121835782CAC635EE2E505FAC726678FA910BBDC462F81E5E85E1C00DB69C274BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 24167f096e3182f59a86ccbd86bc94b700db5e64dcd516ec5089cb1853e35d25
MD5 173ebee8e03a415040c6272c5856990d
SHA1 74dbfece922b42d5623a871a8d134637f29eca00
SHA512 9ef990d409f8d456926aab6a94acb9afa65ad2496458de0434b8d861c478ea0c9c1ecd672f71a760df470341a73b39f98f26530eb5079500bb144f264855dc51
SSDEEP 192:zxsNPVQn0Uo/7+3vJMQmiU1UiWWyatb0sO2b/H5EucMzqgQU8:zxsNPVCo8e3WDa9xOsHeKQU8
TLSH
T15E3219346878AC6359E2E545FA8B36639FB810BBEC462F81E5D95E1C00DB69C234BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e489f34-a29a-4a88-8e9e-881a27ec1ab4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e489f34-a29a-4a88-8e9e-881a27ec1ab4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI37202\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs3ybq34.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fgcfyh8i\cs3ybq34.exe
Size 5.4MB
SHA256 9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63
MD5 3beb58440a523ccbe2661b46fd734894
SHA1 368cfeeabf7d56c69a0f9a8249e790b507bf5d2f
SHA512 3aead9ed23cd893da33b759a36c23195cf5327511c9fcd526b6a44434e1b530f4caad50af14f1328007fc1425ff6ff8197ead0d4d713eee0569996e11ea4dafa
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrB:k7ICteErownP0oTcMsABqlkgczV
TLSH
T120463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads