9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63

Analysis

max time kernel
0s
max time network
9s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
Size 5.4MB
Sample260817-sd2stadj4w
SHA256 9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63
MD5 3beb58440a523ccbe2661b46fd734894
SHA1 368cfeeabf7d56c69a0f9a8249e790b507bf5d2f
SHA512 3aead9ed23cd893da33b759a36c23195cf5327511c9fcd526b6a44434e1b530f4caad50af14f1328007fc1425ff6ff8197ead0d4d713eee0569996e11ea4dafa
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrB:k7ICteErownP0oTcMsABqlkgczV
TLSH
T120463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
1556	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ifconfig.me
1	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7908	cmd.exe
8128	cmd.exe
7432	cmd.exe
4728	cmd.exe
7632	cmd.exe
7328	cmd.exe
7984	cmd.exe
8104	cmd.exe
7796	cmd.exe
6112	cmd.exe
6396	cmd.exe
6448	cmd.exe
2824	cmd.exe
7816	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5972	msedge.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1556	3176	9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe	89

Views/modifies file attributes 1 TTPs 14 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7408	attrib.exe
6400	attrib.exe
740	attrib.exe
7808	attrib.exe
1848	attrib.exe
3928	attrib.exe
6764	attrib.exe
7688	attrib.exe
8104	attrib.exe
7924	attrib.exe
8132	attrib.exe
8052	attrib.exe
6460	attrib.exe
6392	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
"C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe
  "C:\Users\Admin\AppData\Local\Temp\9ef1c26fd6225398f104a35a6812b1239cb22dc7736639d17b7f5a103619dc63.exe"
  2⤵
  - Loads dropped DLL
  PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe"
      4⤵
      Views/modifies file attributes
      PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fffd035c188,0x7fffd035c194,0x7fffd035c1a0
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,12964622372642910322,16969385098276305295,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
      4⤵
      System Time Discovery
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,684475541899640583,4626874032154174378,262144 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,13553625407439344964,11812160888835073838,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:13
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,3518957670481976081,310548323450734923,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,9951524131607863125,15032903076144487591,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,10002580394930391848,14460228855693276287,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4424,i,13859421379101168507,4681861430200425145,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,2212723548299909720,3940179062865555527,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4692,i,2451573304462461362,13199319023538528237,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4812,i,12325604154188122665,8218057819172882688,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4984,i,1037154642805644828,16393967854007491729,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9899260805750580408,11459878409302506350,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6124,i,17290304384470611584,1198677931971196729,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6316,i,9975653765842356523,14090137472706304811,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4800,i,7921501807241634414,17525075737858687878,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,6732515795791117990,4767154156422588043,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,17931670688012080980,11844401211048462994,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4900,i,2638510116003254605,3008827141680575824,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6284,i,8304851797181787948,10294851597945679921,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7340,i,13679496813155207092,1320569581467536026,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7528,i,15350427397502388672,6006323675178677585,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7556,i,6478579083725882152,9909737741854121890,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7840,i,6741989330893336203,8759135537626632360,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:1
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8016,i,2640248247885037110,14121085643703260532,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:1
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8364,i,15719415745354529978,9449535250401645414,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,17682804200744036794,11300085228499362177,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:12
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8588,i,14364841567590610115,5642788700746572580,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8772,i,6740126981101124695,8479178517994311852,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8948,i,17776752984100529731,16807268214149804375,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9124,i,13545200253414459067,2888797847900837446,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:1
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9268,i,16862944586953417270,12739049579004980579,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:1
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9432,i,7915795365529512876,1227235131595878240,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9584,i,13708880722871217679,9136426542035241894,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9620 /prefetch:1
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9492,i,5791316006069460140,13428871870567913818,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10088,i,16585573884555536386,2958727853559678089,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10088,i,16585573884555536386,2958727853559678089,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:14
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9992,i,10339813807609307264,4065236541746053120,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8976 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=3852,i,7496204404860039228,6943149578888524545,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:1
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10020,i,16138086866178108986,8788639660645635902,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4732,i,1800610276279750311,1226001855479826823,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10052,i,4401353193149916302,979914340037210261,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4724,i,1148768349849606152,5120116767321599205,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10464,i,8111157195258803953,1913686022879787272,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
      4⤵
      PID:7904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=10664,i,16168874231533267371,11842800949104348207,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9052 /prefetch:1
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9432,i,6686130744477831973,10866541729838064943,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10128,i,9481150787432140961,13431834569215090547,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10208,i,8237515008384225466,17573056482565978785,524288 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8776 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10416,i,14345251241371542667,4916390843376266183,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7880,i,12835520936027576923,2767507929947429951,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10448,i,1394000756624261527,640701171866001108,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=9020 /prefetch:1
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6072,i,8545537631496894349,7774891535689067990,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6080,i,16507550528509234148,13200721907571013808,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10400,i,11164899276657257419,2225626669656949417,2097152 --field-trial-handle=2336,i,2108427177812459770,6493165130124549148,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
      4⤵
      PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4292

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
1⤵
PID:3316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
  2⤵
  PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe"
      4⤵
      Views/modifies file attributes
      PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6052

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe
1⤵
PID:2668
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tfv70n8c\2odkzlke.exe
  2⤵
  PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6396
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe"
      4⤵
      Views/modifies file attributes
      PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6980

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe
1⤵
PID:7004
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hne739hp\pv34gr0m.exe
  2⤵
  PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe"
      4⤵
      Views/modifies file attributes
      PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6716

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe
1⤵
PID:6336
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9aypp00y\92g00k3o.exe
  2⤵
  PID:6436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe"
      4⤵
      Views/modifies file attributes
      PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7232

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe
1⤵
PID:7476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5rx7assi\od19g6ok.exe
  2⤵
  PID:7560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe"
      4⤵
      Views/modifies file attributes
      PID:7688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7576

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe
1⤵
PID:8160
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0vc5h5jv\k8qmsquc.exe
  2⤵
  PID:7280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe"
      4⤵
      Views/modifies file attributes
      PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7756

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe
1⤵
PID:7872
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfzcf28y\2bgoj7e4.exe
  2⤵
  PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe"
      4⤵
      Views/modifies file attributes
      PID:8104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7220

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe
1⤵
PID:7708
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lnztf543\9yg3vk9x.exe
  2⤵
  PID:7832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7816
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe"
      4⤵
      Views/modifies file attributes
      PID:7924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7252

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe
1⤵
PID:7520
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0q168ft\mg0g119m.exe
  2⤵
  PID:7752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7908
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe"
      4⤵
      Views/modifies file attributes
      PID:8132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7804

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe
1⤵
PID:7844
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yljo2iq4\n9m83ma0.exe
  2⤵
  PID:6088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8128
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe"
      4⤵
      Views/modifies file attributes
      PID:8052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4288

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe
1⤵
PID:5768
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gc6x5a56\pcoukn7h.exe
  2⤵
  PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7432
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe"
      4⤵
      Views/modifies file attributes
      PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7740

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe
1⤵
PID:4900
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jlaczz1e\e2o1qp6g.exe
  2⤵
  PID:6944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8104
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe"
      4⤵
      Views/modifies file attributes
      PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe
1⤵
PID:7364
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8vokpx0\vjf8gza5.exe
  2⤵
  PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzbvrcnd\8b8ezro5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzbvrcnd\8b8ezro5.exe"
      4⤵
      Views/modifies file attributes
      PID:7808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 280KB
SHA256 116caf093749c2e465d1de3576c079ebcf73cdd51283000054e82218cde88569
MD5 cadeb452f59265a41c0faa94b574fc53
SHA1 701cb7cc4374f0e6b766ae145c16d12e2b229a86
SHA512 69f242eb2ebe3ee8387795d02f5f1ea4e586431949fff3bc3423f0bf7e1e27c6704e364c5b80c499275118951d3bc8fc01ffc676d7ec25bbc54627df5a78b531
SSDEEP 6144:zZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMolQKdKX:14MSb7e+BnnPVEOiDy0yjH6X
TLSH
T17C54229610CBBF7AFC380E7D1CDF82A551327658579C8EC0E52A061846BEE98E3C6971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 86KB
SHA256 9bfb7d3891dc41283c1701df9de564a49147cb22fc33b466db734f2f79cc0d32
MD5 377e08789ff2ef14350f8047fda3889b
SHA1 708dc2dff51b96a08b46f0895faf6ee06857b0d2
SHA512 909ab18680af0d38758598161d4ca95ed2e5ba4a098a9031b1f84d4051a51f34c7d3e8d3ccf885e0e454635b2691711d9a406ad9acfde55dcb033e03d68981ca
SSDEEP 1536:vWKxFg7/5QIHoKQVfaUX4EnrSCn7uX9eaADgv9FT/QX+lJdU5PsQv3iWMYSkJsYV:vXomVfaUXrdG9CcVFTQOc53uLHYlDks
TLSH
T1A89312A264CF75FE20F516AFF1911C2F354433A327FB42604AA60D8B4B4D27ED620768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 280KB
SHA256 c01b1d80e64d36c37014cbedc15ccdcf20e826e07cfdaa2094c6d4e470d2c3b4
MD5 e41b573b17e43967fe3e55c14d5dfe85
SHA1 459afe1e3faf34a5a4698bfb602961f1f296ead7
SHA512 f769ac941ae6ba94b361a03c8c3796f3b811d5a0e4c2aacfc23ebc1ee767daf6d5fadbae4c4d27928d59f5daaa5daee91358b0caf9469e1438ee2786e8a46741
SSDEEP 6144:amiJ2UKW82ExgTbtMXV5WlYdI/CsUcBrRmlwrqfQ+XealtgaO:aALWqxGyV5WlOI2cXmlwG4oeagR
TLSH
T12D5423720D90C077A60628E96F8426B0F119E6C17C52D8DAF1EBD4D035ABCD7E678B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 43KB
SHA256 23527dd91c3842a9922b483c5d8c066e81ef9daddebf843beeb9060eef46b206
MD5 9919aa488e5957c9a473565c4de111ed
SHA1 8c72a709adf61bb299edd9fb5176e99fe032d079
SHA512 f5d48682bfc604e8e8742864c0890b0f6d277a495e69cb64a915fd1525461fca2e20fa350a7a80cfbaea134c9292010120d401a06a3ced96564dfd3aea5ad736
SSDEEP 768:Lhy5UT9ub0I7kRG4anF8Ly6ox9jnhecNDS+qp30//oLDWb2KnBrM5:LhyqeUG44t6gecNW+o30/Ea2
TLSH
T1E713F297A7114E2B3F3DA3CD581DE045AE48BAD0EA014CC18E7D69DAF1F60D3C54956C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 67KB
SHA256 638b172264227fb49b4e9742f47e89e194c83f2fea2727e9e087fec664778846
MD5 5ea68132ca85b3e930bb15fc6a21c0ae
SHA1 14dbbaa2886d9c8fc1d99a32c859037bd5f14a6c
SHA512 e8d424849214196fe072e2f0995ab22a111dd2dda8a4ceeb29b97f3abc26061c82676148c3dc7e4099151138242d0f9b6537ebb2a698080542f254213fd3c482
SSDEEP 1536:z4trsJKL6dlOj+a/gPGe6QCeEL7lhB8CCpjVVvzUXFuG:kt4JLlBfPGe6jXnqjVV2sG
TLSH
T1026312F2B13423086B2FDC0F1AE36ED7F751523038642EA445506A657C7E7EB1838A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 93KB
SHA256 fcd1ad346838ef18785e4ed9b176a1f54a14f8a16306cd900e9725ccd8eff4a6
MD5 31b48e0c4d5c8207e08414c0215d2490
SHA1 e6ff576ef660773f89880561cf2ef663b2bc4b26
SHA512 a7ad4679024227d8d22566f6c658d5bb1f97c35335770994beb8fb19b50bb575be7a8d7bd8b8104a931eb1e41727e49330d9fd619ddd421f709697c247983a9b
SSDEEP 1536:O6wFEtINcRdlKh6VDvyWkiaA1zhMSv+7qRGXlpJu66aIqbG8eqJvyyDFPP:SESaRdlYWDv7X3zhMj7qopRi8G4RX
TLSH
T1E69312F46DE588088031B7C21BDF8A597F770A16D60A5437BACAEA36F85AD472DD0C0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 105KB
SHA256 0e8a789210d2e15d3b7922249070a4abf04b8f2c3ca20d559fadebdcdbc3065e
MD5 ac6000daf3f6aba8aaaea3b491af716f
SHA1 b63f44adb4a8289b95fe78082a49a30c47f8a712
SHA512 7f8fa01e51ae39c23bf486b8fee719d877861393e92e4e19d9d0919103b983c9aae197e48a8f43068507ac48d9223a7ff605581f151a3d2c82edc036a945d269
SSDEEP 3072:HGBqPBjrKRj+XbQhubPMs95fIZbLXGZUuaf4ooanvTN/D:HGWgOMhubPMsXKbL2r8B
TLSH
T122B30242C9799A46D6B75AE25E8824134CC91B700CC7E55F2CCC4CA7ED9D323E084BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 25KB
SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
MD5 960038e61249b8206edf905c44f06e1f
SHA1 4eade31097df53ddce9bca4f9d3c0829da38f827
SHA512 0d0c83d8ceebda95004bcc078334576462d9ae8f4536f7c882a13fd1770ca8fb6776149c3984bd177c07acf239bc0d5507e2a9a3617c63d972d0f75eab40ac21
SSDEEP 768:U6v1HTpbmOblQZkN4yU5+vwiZdwQUKBw9xGU+X:UAzpbjblQe+2vwkwQTsGvX
TLSH
T101C2E1C07FEA088D4A711A697AAAC9437189676EC8C43D4EF7C20167611F2DCF6C1D64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 25KB
SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
MD5 9d23ecbf96471315bdda15e799bf1a60
SHA1 783505e687b300d1f9f51691c0cbd9f9ef475527
SHA512 9ea87e5eaad047ccee4eb90e603e0e0944fcbe56c09c33d91fe7ae58e226e668a6484ddbbad3632f10ed972efae93114cc25f08ed9eec6d10a57c9a16cf12ca3
SSDEEP 768:M0sY2oZb5o/PDS54I5BQOweAsU2lSrvBqwH4Hdcvqs:9lzFGG2Ijfj8TP3v
TLSH
T1EEB2E1833AD334B171B5E0A9609D4B1294382AAFF34E851AD9027FAB6496F111535CEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 39KB
SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
MD5 a66c17e7abca7b23237b620b38f9c157
SHA1 66c6db056c622165734c76120d4c2961d35b1688
SHA512 a3f55b0fde8b5fb80dee4f05c96efaa3ce4628564fba165c7cff1dcc8e916ebed176e3f9f42a7f7cb5060780028fe6c7210c1f63a6178b7c174d17ec126a47ca
SSDEEP 768:ciVI7XMoMiNQgmb5xqzbWWxVNl5dXAU3nDu9hSO3UFneF+4wg:cgKM3olmdxq3WWxVrXTXDu9hl+neF+Lg
TLSH
T1DE03013EC774BB2B841B2CBA41D2DDA438F85CF214E61D055FE2A976516A72EE1E0C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 19KB
SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
MD5 96bbe1fa7c6e027e618cae0f28c99bac
SHA1 30233d6bcbdd33cd6c52f815efe7fb1d39625ee6
SHA512 b53593fa3343dd6965e9b62ecb8cedcecdd278ac72e6ac9615b44b5d26cb989a2d06389083db0bd66cedff3303f362fbb879ba7b38eead6d45960b891af7db97
SSDEEP 384:x3rcp/4YBntISYT1NRTahSuoW9gkT0ID47crELVwSz4Kc2L3yaFA1qU424C:R6DRmr+hgJbI94p7y7qh24C
TLSH
T1FA92E1C7E7DCF15D896E95AF266F82D1AB38753BC219211C64F490DC604EC116774B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 21KB
SHA256 d87ee0accef9bf0955a0e85e7e458b19c2bcab2b0ad53f350d3d2b3b6f740f99
MD5 dade4f80440fada5643fbb9b1d5336cf
SHA1 fd6dc9e3ff445614f6627cfbf5418677e8d866f7
SHA512 9fe25a4981983059989e094370016a6b87700eab8feaeb0a6453a8f12bb5a32fa5b00809db98008bc2a7365db6287c786d19ad533c7ad7dc9fe9ab0eb8501b4a
SSDEEP 384:9iRzNDSyRnxox0WG8AC/qxc4ktq4JydBD0HKkW4hFbNW57tG0YO0IGRdtP99WzG8:9SRZnxU095xcZ4nWHKklVY5ZGbO9gTA
TLSH
T1C0A2E1A2F94FF5817E4A90322483C8F44CE5658A9F85ACDD8695CC81E11FA927BCD7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 92KB
SHA256 48116b1c9b20ee76a47b734cdb502dff2818a7856bf844e0f98d3563f84365fe
MD5 f9e9736a256d7707108b94b549680958
SHA1 f11119f200b93c33ef9308ba9bd110bde4f95acc
SHA512 9a5e6870040a029ca99456200cafca47e4bad732883ae10034399f7c5b6543047b46f5766e017a3fd79d75971e8fa0d459f60c6f601eb754dce1e9e2e557a5b0
SSDEEP 1536:qrB+/2ACdU1UKoDo0J8ymZFrhGCX49wRDM0YySwoqTP4mG/4nXd8TKwEJuzHdykD:m+dCdU1UKok0HaFA9wRw0YuoqsmGeqO+
TLSH
T1649312EEEBADD166155EC72842D8848F847E02F0C109EBD60F89D6E3813783A5D398D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b38c12077cf82128350b46d504af6075a57243963b717b88556b1e317cbc09d
MD5 cd4e5388903fa3297949da842c25d7cf
SHA1 17a2e1d2a3079768cd2a0f60fe8a5cd1a822c4aa
SHA512 f3302f7d8faa9245a11d9b45add502deb943fafd72f2cfb99fff41b483e14f8df2d4ac35da09d960cef325dcfee2b88761e758eca0bbd747359f1b268640152e
TLSH
T17381A8952BEB1BC2C79586F19DEA082A36F0C85625CF1F31144E6DB36B42F2E5BD0023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6b2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a6b2f.TMP
Size 2KB
SHA256 cdd4114b5594a6e3c6e52c574b461b0596ef950e33a329f6bf54584f0aa5728f
MD5 49440f11bbb9498ff3c9d6cae54bef47
SHA1 215b7404d7c7b2efeb8111e1f82d35ab06455c8b
SHA512 ff7a18563bfd12a3fd881f251da3dc159e823bcbfe77c7c5717ee8dea5f57088811bc156304c0155991fdf3fe091c9e01b24044bba9427085c47c6e5770b048e
TLSH
T115513E512BAB5BD2C72687F1DDEA046A36F0C84861CF6E30404E6C336B02F2E5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a1cae005b2ddb896d9dec3008adaa72fb5c1b247ec1392e8fc561280a331a78
MD5 c43c7ccbda55eb740907369fe93a9024
SHA1 ce949cd9d885afe58ac511db1916ac9a77857e51
SHA512 658a7083cc7b9d5e80618903e4e908e269b1548d55e91b3a3a38de1491893c1db9c8257ca7d10f3f4eded6ce3de24945ccf688ea7bcaa964d0073068047cd0c3
SSDEEP 192:sxRrReCr/fBsWJwG7zoA8pKLAq0FXHg6+WNsZfz6g1zBXpYBQheCYyNGxIgDPfJ:sxRrrr/fBsWJpabt5ubVp5Rm9
TLSH
T11352D91669286D7B4CD6E219FA15FB53E3F51072A1D01E48FBFC961C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 81d595b147291e9eef2724a3b1f7b1b3f134cba407005f17b020008aa655d60c
MD5 d0a85ada6677004ecdd5842e3fffe53c
SHA1 4a6ab02925173e09291c015a476e9bf0523f93a9
SHA512 64d8d766370ac47548a86cbe67ee00bdd9026509e456435899d0c6570ec99af826eed26696dcda1404591c7263029680f0cbc8bd26c24f7167456ae579736b69
SSDEEP 192:sxRrReCr/fBsWWwGxzoA8pKd3q0FXHg6+WNsZfz6g1zBXpYBQ5ICYyNGxIgDdeYJ:sxRrrr/fBsWWpsIt5ubVpDRm/
TLSH
T17152C816A9286D7B4CD6E219FA15FB53E3F51072A1D11E48BBFCDA1C00E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 80a0cd27f4b630fdef565c53be0d37dd2700b70134b9879b5b238ff34680aecb
MD5 f1b8fb244401699151384456a4ca151e
SHA1 eb236c673c313fbcd7172be473f6ef3ce246262f
SHA512 4d1599ec3185e4c78cc96c480494f697db54ec4b9b207063685e2c626eeb2e39aa2b55d6682e232f2fb8323534361a0c43f5f792e7afc6b9dbbdd1b718fcf2a1
SSDEEP 192:sxRrReCr/fBsWWwGAzoA8pKRIq0FXHg6+WNsZfz6g1zBXpYBQ5ICYyNGxIgDdeYJ:sxRrrr/fBsWWp5Nt5ubVpDRm/
TLSH
T16E52C716A9286D7B4CD6E219FA15FB53E3F51072A1D11E48BBFCDA1C00E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f8a7bf4813702a6536c97ccf43bcb61cee3d708ce7fa9f4cc3a77001a4ba8b88
MD5 c6a1ce345d4348578b70be33fbfbc60c
SHA1 81ad0cca4a01279ac54d9981228f2477e0773efe
SHA512 fe57e7c8c3c28e400bacb3488bb6e1a5e2f6191b2d844834d086fa44050e16e7253ce9b3db7c6a7b7398a3d9d1d365b9110f8a9b4ae1dae1d82cc6bff51f363d
SSDEEP 192:sxRoReCr/fBsSJwGtzoA8pKH8q0FXHg6+WNsZfzBXpYBQKeCYyNGxIgVzJ:sxRorr/fBsSJpgft5uVpiRmj
TLSH
T16842B8166928A97B4CD6E219FA25FB53E3F51072A1D11E48F7FCD61C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7ad417b7a9252c555c14f091e7190af9557484586cbb5b3b5aae43c1734962e8
MD5 b36ba365cc0da31f75c695014bdfb0b9
SHA1 bed3a75b4562c9cd4ad4a8d4ab4b020884441857
SHA512 15e41e069f6f2ec75f28aca65534ffe5c52ac41cb3ea80856b8433755248662f18c92526d8e66b20becc6248f2e155cddcd9056994b275086d8d3e249051eadc
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV5Vuwdro9Ee0Ur8:j26HRUE7MRWgs2f02u1jai4wWz8
TLSH
T196C2DA6B740CCEBE4F800ADDED197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ec57d10ee6876a1e563c4197a392e9d1275c23f5cd1a1012a481457856c5c4d4
MD5 039f3911ce8fa78fcea6bf667eb2a1bb
SHA1 3f0fc4999a4c5badb1ddc885ac23166b5b3d568b
SHA512 812a0b5e23196474ed7e24798ac781ba9be7f7a9bbd311a305ce5f5ba768527d3a12c27ab7170571d5b4af3bb25b752eb6060bd984a7cb229ca434f744780290
SSDEEP 768:Trv+4UNbdz3Kn/TBOWGatDttONXyer1IRCzniwpeVH1SK7:TbsbV3epSIqndEH1l
TLSH
T1C503BF31A0A8DE334DE2A396B14777537FB82067C9840B90EDEA1F8E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bd247a2ba47edb3a7570a8d48a46ffabfeb0d638477fd3abe6ce65e27ffab621
MD5 d18c0014478f69f09b07781d3e59ca42
SHA1 99a0144e02a0543b47bcc0a729c09a032bf6c2b8
SHA512 a6a994fe52589ba6317a2a1f63f470ee8bbaa7c24954137ad7970cf1f70b9ff1d8f3c02e8493e74f51b73a888c08fb1c6b5777d4eb15e6af5820f11aed02ceba
SSDEEP 768:hrv+4UNbdz3Cu/TBOWGa9ONXyer1IRCzniBfeVH1SK7:hbsbV3LNSIqnwEH1l
TLSH
T11603BE36A4A89E338DE2A3C6B14777037FF86057D6840B90EDDA2F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a3f5718f773830f60761c00139501f661a22e05af6df5c5b31c7223cdd3732c5
MD5 836471508275d91505e23997e4a9a4cc
SHA1 22fcdcd7d57781e6eab3c12fb93fffd2e46ee82f
SHA512 639088d170ad6a5c4c8c15fc173b590ca82ea59796d2c38e8cae7a7edf90e95a828431eedbd8f012d1a8b9cfdba429ff54d37cccc238dd0a503b6de155a87ef0
SSDEEP 768:Srv+4UNbdz3qR/TBOWGatDttONXyer1IRCzni9peVH1SKk:SbsbV3MpSIqn2EH1m
TLSH
T1BB03BF31A4A8DE334DE6A386B14777537FB82067C9840B90EDEA1F4E059759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 96abd9a1783e10fd000441e86fe1b1e267a94f327186137ee9988f869da79d1a
MD5 a486bc32d28074b025808e38ca904638
SHA1 3af2880cf939d8136bbcd61f56e9785d07fcdb42
SHA512 a138d65615d161f322261f967be267afa91465fbd6e79247410e907ce7c45bc7a2e2a2ed0ab0f5d05a71b59599bc17e3675e8c015d500fe2bbd4753a59d73331
SSDEEP 384:nNZcIK38NHGBaMQJuhf3RTpXOVc3mXzFjcXdXDtUGrYGgAN8SyrCZr1IR0VhMxAs:VK31R/TBOWGatDtUONXyer1IRCzni9pr
TLSH
T1BEE2AE71A465AD234CE6F382B2467343BFF86073D5C40B54EEEA6B1E048365E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a1670cb4e1b17332b3f4501d8597ea78d3d8c613311b12265e9cba4f5e3b0061
MD5 3d42431ff92601fdf50e8be08aa16a73
SHA1 4ad7f1b34084df6b676fce7e127eca3ac274bfdc
SHA512 1bdbbf21e186538add7e12bb40c40fdddc896795a22d94391382070185493e444fec590e878b8007ea51040b22ed088dcb0c2976d5284ad5c78e9b95e2d16846
SSDEEP 384:nyZcIZ38NH3BFusJuhf3RTpXOVc3mXzFjcXdXDtUGrYGgAN8SyrCZr1IR0VhMxAs:AZ3/l/TBOWGatDtUONXyer1IRCzni9pr
TLSH
T1C0E2AE71A4A5AD234CE6F386B2466343BFF86073D5C44B54EEEA6B1E048365E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d5896f6f47f3866c3a4bdd0c6730c86c30c62909be2f2fafe6773469ec270a00
MD5 f31e92b3a4eed651ab8fa8a098adc6c0
SHA1 d840b9670b537a75ce479a69864cc51c2bfd3222
SHA512 8ecad662d1929b67d49968ecb05e256235700201f905f1ab5020b3409dfe0f92bbe09951310da0997b11082bfd25cb5aa9cb7db74e5fdaca6c114548c82ebf2b
SSDEEP 384:nyZcIt38NH3BqpUJuhf3RTpXOVc3mXzFjcXdXDtUGrYGgAN8SyrCZr1IR0VhMxAs:At3V9/TBOWGatDtUONXyer1IRCzni9pr
TLSH
T1DAE2AE71A4A5AD234CE6F382B2476343BFF86073D5C44B54EEEA6B1E048365E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8bcdcf6d220e10aa89f24236c19f8efd2d327624fc482992bf859fdbb3919954
MD5 f0713eda6ea4ca16e62e3c87f22cf084
SHA1 19c78ee8bf1d68b7ec4cc0fc78dc1a801ad164e9
SHA512 712a4516ed0822cfe9ac8615a4df339614b0dbe3bc8108a7faa9caa60dc260899556efaf775b74aba10ae141391607ab12f6aa41e36b8b41bac6082f3a8e8c06
SSDEEP 384:nNZcIiR38NHGBfxqJuhf3RTpXOVc3mXzFjcXdXDtUGrYGgAN8SyrCZr1IR0VhMxr:VW3bb/TBOWGatDtUONXyer1IRCzni9pr
TLSH
T1D2E2AE71A465AD234CE6F382B2466353BFF86073D5C44B54EAEA6B1E0483A5E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9df43e8293d81f0f8a50460460d92362764664608c2d5d9e02203da055768db5
MD5 39008304a2f90c4eca7a60f7a0a4c04b
SHA1 970825c35823a4a45670064c0f6b87923a142423
SHA512 79701ceeb204f70bbd4b32544e504df537e77637a96024e447039608eb3acb6e16e0e32826ccfa3f29288c597a301922aea3b81ba5ef64ece298d08799115575
SSDEEP 384:nNZcIL38NHGBsWyJuhf3RTpXOVc3mXzFjcXdXDtUGrYGgAN8SyrCZr1IR0VhMxAs:VL3lT/TBOWGatDtUONXyer1IRCzni9pr
TLSH
T12CE2AE71A4A5AD234CE6F382B2467353BFF86073D5C44B54EEEA6B1E0443A5E170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 efa6edeb118bfbdc983fc9c3d63b8de354f5f8fea53b911c24204a97a8f47cd1
MD5 08ef52bd0d6279af8b9022f7855b032b
SHA1 56ace5eb3140502c0a1fbde8bd783c835fb97d4a
SHA512 484ff37e0463221c98e28a60a33b8659000381b5692e49ab94c19a10c38de0396ff537856b5182152acadc2c413de20eff5a53371e27c4cf422c1e8ddf71e3c4
SSDEEP 768:krv+4UNbdk3/L/TBOWGatDtLONXyer1IRCzni9p2:kbsbS3zXSIqn22
TLSH
T14C03BE31A469EE334DE6E396B1477743BFB8206784C00B54EEEA1B9E058759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4f5f4f7a992bb20d2ec7fdb002010848f02fac990ef94deec68218a07227da51
MD5 2129be8a1a10f5ec0f3851409ad7b273
SHA1 12a2d00a11fb29e122c047b28c25067e58d9ce55
SHA512 d71281ea9875c11d45ca115c8557656d464ba2e95dcef484c4e515c4c04e5ffc92830a101a9df8fabc523c10dd7d020cf13c23ca19c30217bf1a6b2c022afb3b
SSDEEP 768:orv+4UNbdA3jB/TBOWGatDtvONXyer1IRCzni9p2:obsb+31zSIqn22
TLSH
T1D503BF31A469EE334DE6E396B1477743BFB8206784C00B94EEEA1B8D058759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46a734a3-d1c3-423d-98a3-4d4c5aba3e98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46a734a3-d1c3-423d-98a3-4d4c5aba3e98.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\libcrypto-1_1.dll
Size 1.9MB
SHA256 f9d61f65e0a96bd7a57783b57d5bc58970a39cfbfdaef8cf4e7ab26c5e8459ec
MD5 69c51217758449339ae9aec6d97cb6ec
SHA1 2d602e63950703a9ecf06359a51d7bcf7ae2e0bd
SHA512 73a8b9d0f479bad043a779cfe5061e68048adb66230a61ffed2e925252b37688e4f9a142a5fc73892e1341fd44a1618582deaf88f23bee22f9efbe6ed42ae2c5
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AHg:6XH+n9Z+1g
TLSH
T1FE958D66A2E800C8D5FAC17CEA979527E7F1B46A13B09FDB14B585B90F13ED1623DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\libcrypto-1_1.dll
Size 1.6MB
SHA256 45fe366f97c81fc53f74332a89ad27279cac71ae81cd036b4daa8bf7266b6320
MD5 52d18bb4c06a398d347ebfb7024cce1a
SHA1 f4ec0b72910019951eb46a61e5384a540466447c
SHA512 6b3c9b7bf1a42a6e1fe97d9158c53824fffb595e4a637da70f292d5e6475be76da96e14eb1ca845ac74ab7e59035d4abd9001e94eec7c22a3d8697e7b83dc7ac
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6l:6XH+n9Z+R
TLSH
T190858D56A2E800D8D5FAC17CDA9B9517E3F1B46A53B09FEB10B585B90F13ED1623EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\python39.dll
Size 1.6MB
SHA256 cde634b8c713190c151f4d2905e06c85462ba9efbd56ae17ed7f8eb3767ee40c
MD5 4aa40974cee10d677cea4de7eb3556cd
SHA1 497d40c1dd31fff51adc3f7bbe29015fdccc7d0b
SHA512 0b23ccfe825aab9f157aae6bd62e4931d6c224755cba93f99790aa9332a2cb28be74415db1d1c8646fc5e6cfb13c33f3a8ec5cdd1febd253c5900675d32aabae
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uj1:/2v/ZWrVVYRKyIM
TLSH
T1F9757E5653B820D8DAFB9095C905964BCBF2B8566770938F42F04FA62F739A3235F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\python39.dll
Size 1.9MB
SHA256 ee4c1d06e57762361d130884c7fc4ce8d5aec8bb3139d7aba247616600fc1faa
MD5 1aab918428693de4680b680e066de0ff
SHA1 1c8328b5491440beebef5648016d372efa4d52bb
SHA512 c4e276762ba63f53a5d7423abc369f02bb355aff42696c0fdf70018c9948ffc26e4e7c7526ff8ad083b22465e6e4212bd0e4e9380cb79cc8bcf10452b7f60a35
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uj3:/2v/ZWrVVYRKyIFW
TLSH
T1F9957D5653B81094DABBA094C906D65BCFF2B8565734938F42B08FA62F73DA3239F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31762\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33162\libcrypto-1_1.dll
Size 1.9MB
SHA256 a4283b11162e740c8f0489dd958f7547931a741dd7c3799f597f7cea3ca960fa
MD5 d46cf81fa2d2226717da2606430a62b6
SHA1 820d634c0e0af98d83f41fe26e4f9c67cd31e873
SHA512 0473d90c1b150d7e42d8da3d566a90283a71cb8b4fa79a3dab9670698f2ff3a5f1f4faa7e6358fbcf2d4a19c01a9fcea0449543521b8bf54ed7d9e8b887120a6
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH2:6XH+n9Z+12
TLSH
T197958D56A2E800C8D5FAC17CEA979527E7F1B46A13B09FEB14B585B90F13ED1623DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33162\libcrypto-1_1.dll
Size 1.8MB
SHA256 89f67e3cfee24a7430f6b605b71b0a4470447c649cefd1e90f1242c8f80c986a
MD5 b88f43952297b7ffc54c748cc56b0447
SHA1 40f07f56cf561e848ea3c233f436fcf62923d18c
SHA512 cf070095f78b35200aa9e2a86a5a27cbd455dfd78228e707a9d7ab4ebb841751f84ffa5f049be3f2d23a453ccbccff46fb89a732a5bba745712da869e9e55f49
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3E:6XH+n9Z+H
TLSH
T174858D56A2E800C8D5FAC17CDA979527E3F1B46A53B09FEB14B585B90F13ED1623EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33162\python39.dll
Size 1.7MB
SHA256 1af630e3a087268d9d07e32b5cd535282ee4b222ef77c8a4f5461667fb9608bf
MD5 5e406df46b47e3f40ba03e7d74c4244d
SHA1 4bf9a3e3914fb5e94c6d976f058036419798922f
SHA512 7bd858b8a0366f5e88f54fb5dbeb2b636c4e3a24cb12a1038666687a0e077f9ed46cfbbd5060e58acd6adcddedb3de934bee530b6c69739b7c3c19b437224ccc
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3ujf:/2v/ZWrVVYRKyIM
TLSH
T19F857D5653B82098DAFB9095C905D65BCBF2B8526770938F42F04FA62F739A3235F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI33162\python39.dll
Size 2.0MB
SHA256 13626f6d4995ad4ce88beca4f8b6afd73c6367f8b9fb16ff493c3e790ea9ec60
MD5 d7dad2de74dfdd5381106079542830bd
SHA1 71d05d9e0643d491818d97aaa2067fd58fa0ad23
SHA512 5be7299fce7acba83db51890063928b28b58695f9db8ec7f96a2fd3b15c9b28288e47eb87487c5d6cdfc9ddfbeab5136429d34af87f74521d6fcb1df1a320fc7
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3ujr:/2v/ZWrVVYRKyIFCN
TLSH
T1FDA57D5653B81094DAFBA094C906D65BDFF2B8561770938F42B08FA62F73DA3229F701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI63362\libcrypto-1_1.dll
Size 1.4MB
SHA256 ec39d9c79fb9080df370c253ce82c784668483fb4dd57a9e52aefc061b6d9289
MD5 2a00e9a8e7a8519063f747465b86d12b
SHA1 1a0711629f3555509bdad9ac707e20391fc92abb
SHA512 2afa4e56e4bd5d67548d1d678f38457c27320765243b926f0c063afd3e737f910d80fb3e0dbd25230c65163f437cd57de582ae62320a70cac7dcc509791e8638
SSDEEP 24576:WRuTKuk2iPAVIH06iyssOjPWJJrIMdxn1jNktvamJr1KHH:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+H
TLSH
T12C659E5AE2E800D8E5B7C27CEA5B9557E3F1B46A53B09FEB10B585B50F03AD1613EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI63362\python39.dll
Size 1.1MB
SHA256 0a5d7a8388ffbe9d85ef3f71e53c9cdfda8150bfc4769420affbd84171ef93f8
MD5 52a1b15a9b1ab676462697ed8aa49a88
SHA1 5222a05c35b73a00ec75ccf4f00bb13a20b3bed3
SHA512 821c27fe761d4b0ec763354b3e5623d2b5f0abfbf201ec1ef35bec27c7dad0875545b84de85e667ca1d02c3c536c7054f0be37fd3f733ded00d2f273d3019fa1
SSDEEP 24576:RJVvVhdnYt77GC/ZWLxETVYC/KVBCaJq7Ays4OYWKOijOyG6Wt8nMpfQxOR:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7XQ
TLSH
T12D356D5693A820D8D9BB8059D945960BDBF2B8136760978F43F04F962FB39A3335F302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abyarkc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
Size 1.8MB
SHA256 27b748409164027dd48d16994a9b4491d4ee1b40f878de359aa2e5804742493d
MD5 9d6613fbfd64006921139c4fa16ce9ca
SHA1 bf2ced631a444fd4008e8992947c72c04d1aa898
SHA512 1f6362a3e3545c99573397f997586115dc15b3377137e661c6329eb28426b4fa629b078a864c9f50ba18bc6451114b7533a010b03b0167d6087bb33c5cce4ef1
SSDEEP 49152:ZHx4wsCQPtJtzfXw+aiVXavoXhjk9fwf5:6CgtvzICDtPf5
TLSH
T105952248B3E008EAF9A3C53D85639511D672BC260764C6CF17A8D67A3F336D26D3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abyarkc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
Size 1.7MB
SHA256 a17815110b4ff55c8ba87858d5bb8abb31b37e4399f491fd633633718a952f9b
MD5 2cb7f277ee16c06b4eda853073ef5af9
SHA1 c2618f2c9d4c2b3741f9b09501819fcb0580dabd
SHA512 eee31ab4b0275e7d2d758d9d4db02fec2f8239338051d4f55bdfe09d9cd0c943dd8a617cb2a6f9ad1fa234ba6439abdba31a567c25784a438798af01ee4206fa
SSDEEP 49152:ZHx4wsCQPtJtzfXw+aiVXavoXhjk9fwfM:6CgtvzICDtPfM
TLSH
T14E851248B3E405EAF9A3C53D85A78541DA72B8260760C6CF07A8D76E3F336D25D3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7abyarkc.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rc70y5ym\7abyarkc.exe
Size 1.6MB
SHA256 94e5fdd11eba4f62eb9e0e8b6039f4ba8b0c04bddd96762c6675bf8df2f78ecb
MD5 8bc2b34ee9b579f0aa359522927a15a7
SHA1 b51a5ba377f960bdf8327dedd354c84b720621c5
SHA512 5b41f6fdb0fb5372d24c47b9f842b130aa42a0dd900d7ffa742927ca86eff35d36f8dd71dc883557b8e5e68cada30289e2fb31feff3ba67a8c297dd6761d15e2
SSDEEP 24576:TFHIAtx9kweZiUv98ZCN0lQG2Okt/XxTxKglIsfrrjXwXuaoF1/+2VDWvgRBXhWi:ZHx4wsCQPtJtzfXw+aiVXavoXhjka
TLSH
T10575224873A419FAF963D53D85A78501EA727C260760C6CF03A8D7AA3F336D25D3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uop5qe.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uop5qe.exe
Size 1.9MB
SHA256 4a000dfcb3a86121f62e185ba431349565825e902d7d10f989e78e23d270e316
MD5 cabb40f1dfedfddfb5ea2ff6f3f83c46
SHA1 4f0dc43d4244dfc69aa1ac310c4300fcdda1b6af
SHA512 fc624fb6a7f83345b6bc3e01b199d7027d8e92503b0e86469781101da81d2401613badde05b9470bd70ba0098bc52c96a2ac944131e27ec84a05d99ac3a803e7
SSDEEP 49152:ZHx4wsCQPtJtzfXw+aiVXavoXhjk9fwfY:6CgtvzICDtPfY
TLSH
T19A952248B3E009EAF6A3C53D85638511D672B8260764C6CF17A8D67A3F336D26D3AB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads