d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c

Analysis

max time kernel
5s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
Size 5.4MB
Sample260817-xe2lnaxbmc
SHA256 d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c
MD5 6912d1370c9077fc61588321b76a036f
SHA1 81d679683990e947ae92a620bd5d0e614d67eb50
SHA512 a0b4a07baed37789be8c9b8a16c90e651880bb8e03edc69526e9d48535f3edd0d4967ec3cfa2a440a769348a8b02f24ff4a000ba76915fcd13e3bf81aab5ceef
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNH:GHICteErownP0oTcMsABql4Ut1
TLSH
T1F2463348B3E809E1F9B3E03D81565221D972B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i5tp16.exe	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i5tp16.exe	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe

Loads dropped DLL 11 IoCs

pid	Process
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\43ccw80u\\0dpem3yw.exe"	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
676	ifconfig.me
1200	ifconfig.me
2032	ifconfig.me
2683	ifconfig.me
2790	ifconfig.me
405	ifconfig.me
109	ifconfig.me
135	ifconfig.me
204	ifconfig.me
572	ifconfig.me
593	ifconfig.me
698	ifconfig.me
2926	ifconfig.me
1497	ifconfig.me
1	ifconfig.me
194	ifconfig.me
397	ifconfig.me
839	ifconfig.me
975	ifconfig.me
1832	ifconfig.me
1957	ifconfig.me
276	ifconfig.me
906	ifconfig.me
1671	ifconfig.me
2247	ifconfig.me
2480	ifconfig.me
2571	ifconfig.me
2697	ifconfig.me
2848	ifconfig.me
145	ifconfig.me
570	ifconfig.me
1381	ifconfig.me
1492	ifconfig.me
1902	ifconfig.me
1967	ifconfig.me
3006	ifconfig.me
61	ifconfig.me
216	ifconfig.me
857	ifconfig.me
1325	ifconfig.me
1520	ifconfig.me
1732	ifconfig.me
1873	ifconfig.me
2366	ifconfig.me
218	ifconfig.me
687	ifconfig.me
894	ifconfig.me
2027	ifconfig.me
2505	ifconfig.me
2618	ifconfig.me
258	ifconfig.me
1063	ifconfig.me
1624	ifconfig.me
1847	ifconfig.me
2104	ifconfig.me
2162	ifconfig.me
2467	ifconfig.me
2569	ifconfig.me
254	ifconfig.me
355	ifconfig.me
510	ifconfig.me
1376	ifconfig.me
2106	ifconfig.me
2252	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5612	cmd.exe
6836	cmd.exe
6540	cmd.exe
6244	cmd.exe
6256	cmd.exe
7036	cmd.exe
1288	cmd.exe
4352	cmd.exe
5656	cmd.exe
6716	cmd.exe
2728	cmd.exe
4668	cmd.exe
7864	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 5380	4132	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	89
PID 5380 wrote to memory of 4352	5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	90
PID 4352 wrote to memory of 2856	4352	cmd.exe	92
PID 5380 wrote to memory of 2868	5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	94
PID 5380 wrote to memory of 6044	5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	95
PID 2868 wrote to memory of 968	2868	msedge.exe	96
PID 5380 wrote to memory of 1360	5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	97
PID 2868 wrote to memory of 956	2868	msedge.exe	98
PID 2868 wrote to memory of 2816	2868	msedge.exe	99
PID 2868 wrote to memory of 956	2868	msedge.exe	98
PID 2868 wrote to memory of 956	2868	msedge.exe	98
PID 2868 wrote to memory of 240	2868	msedge.exe	100
PID 2868 wrote to memory of 240	2868	msedge.exe	100
PID 2868 wrote to memory of 3840	2868	msedge.exe	102
PID 2868 wrote to memory of 1284	2868	msedge.exe	103
PID 2868 wrote to memory of 3840	2868	msedge.exe	102
PID 2868 wrote to memory of 3840	2868	msedge.exe	102
PID 2868 wrote to memory of 1284	2868	msedge.exe	103
PID 2868 wrote to memory of 1284	2868	msedge.exe	103
PID 2868 wrote to memory of 1728	2868	msedge.exe	143
PID 2868 wrote to memory of 4368	2868	msedge.exe	105
PID 2868 wrote to memory of 1728	2868	msedge.exe	143
PID 2868 wrote to memory of 1728	2868	msedge.exe	143
PID 2868 wrote to memory of 4368	2868	msedge.exe	105
PID 2868 wrote to memory of 4368	2868	msedge.exe	105
PID 2868 wrote to memory of 1428	2868	msedge.exe	106
PID 2868 wrote to memory of 1428	2868	msedge.exe	106
PID 2868 wrote to memory of 1428	2868	msedge.exe	106
PID 2868 wrote to memory of 2752	2868	msedge.exe	107
PID 2868 wrote to memory of 2752	2868	msedge.exe	107
PID 2868 wrote to memory of 2752	2868	msedge.exe	107
PID 5380 wrote to memory of 4116	5380	d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe	108
PID 2868 wrote to memory of 1256	2868	msedge.exe	109
PID 2868 wrote to memory of 1256	2868	msedge.exe	109
PID 2868 wrote to memory of 1256	2868	msedge.exe	109

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2856	attrib.exe
5784	attrib.exe
6864	attrib.exe
6868	attrib.exe
8088	attrib.exe
4124	attrib.exe
6896	attrib.exe
6764	attrib.exe
3440	attrib.exe
5332	attrib.exe
3260	attrib.exe
6192	attrib.exe
7144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
"C:\Users\Admin\AppData\Local\Temp\d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe
  "C:\Users\Admin\AppData\Local\Temp\d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe"
      4⤵
      Views/modifies file attributes
      PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x354,0x7ffe9af3c188,0x7ffe9af3c194,0x7ffe9af3c1a0
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,11907844559332554184,12317130455356760250,262144 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,13465201302865832246,17186336053458761623,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,10549173749526442816,17145579470016880953,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,4086324902211127295,1975731795526078196,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,11981030976435077074,13214527773609018838,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,14618744473974802161,13782468177281608564,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,15270516600961389795,14521899021618030746,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,14019584626918926095,32640842670886805,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4712,i,8609042986324259919,5274649172676791035,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5420,i,6029907976847737890,13103695264180008251,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5740,i,13273603205248609962,11947393790524440643,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,17576667872448252679,12952022811673807638,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6084,i,6015824131810845478,10236759601485385540,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6240,i,15694234869250739581,17725655339802191515,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6428,i,13380534243401578416,17880672993263759203,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6588,i,152730395737165887,12488701253160598436,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,18024584367708831137,10370574724721604583,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,8868230492819095907,9917761799152123949,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7192,i,8440576346554687137,16926710385025208007,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7380,i,16516380993980127162,6835620070798014823,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7520,i,3147945757246322231,9008640833276153077,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7684,i,17824498147381936097,11011603893399637996,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7876,i,2178003184577471013,11347720055890128571,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:1
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8052,i,15250252803583425195,7639119619389958186,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7476,i,11827169830055111927,12771880039881824215,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8356,i,9982242873777758128,9726818933711422080,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8532,i,4245893449152923282,10351992659812515047,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8532,i,4245893449152923282,10351992659812515047,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8440,i,18822575952092839,4207425979860973907,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:12
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8876,i,12572988523943199137,7504561894955929695,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
      4⤵
      PID:8156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8804,i,12081616638916429755,4301580283206063564,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:1
      4⤵
      PID:7856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8896,i,17583629064035767857,12915651442102871454,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8912,i,13718802025247007422,1473604325737054829,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
      4⤵
      PID:7860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8944,i,4860115417093592679,6833880162441416139,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9004,i,14868648629754116420,3384176559800244612,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8924,i,4337175857361433883,6889374673785410967,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6052,i,7920855606231778297,7688047775036733513,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5932,i,13548429050311672136,3241865389921292039,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10916 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=9072,i,8629972062582353032,2202089020882037301,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10956 /prefetch:1
      4⤵
      PID:7340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9164,i,7588003143176141318,14903976815469280475,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:1
      4⤵
      PID:7208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9196,i,6841613893550507801,2587165501049914942,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10996 /prefetch:1
      4⤵
      PID:7320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9228,i,12529730918633171918,194350021910148465,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11016 /prefetch:1
      4⤵
      PID:7356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9260,i,17312963045248302316,15851458890388951778,524288 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
      4⤵
      PID:8184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9576,i,2262846805076332438,51586467325673427,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:1
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9604,i,3582885516160507759,8447840432520532409,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11060 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=9044,i,13939839461222135559,6294285194251792844,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6064,i,13819589362131291799,6967600746025100637,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10876 /prefetch:1
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=5996,i,7568689039575694785,5135673944061167871,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=10936 /prefetch:1
      4⤵
      PID:7920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9620,i,17979796373654467462,13509249737458738227,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11112 /prefetch:1
      4⤵
      PID:7404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9628,i,18130715551278193,16856060491262671005,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11084 /prefetch:1
      4⤵
      PID:7344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9544,i,5253443032869096437,7748738533064969588,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11124 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9500,i,12060151864836517300,6191236213230153382,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11144 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4500,i,1520233600100693533,3280887746645785038,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11164 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9632,i,15865685208817683575,1724189374507565076,2097152 --field-trial-handle=2308,i,1376785150941934828,7103119039384664331,262144 --variations-seed-version --mojo-platform-channel-handle=11184 /prefetch:1
      4⤵
      PID:7432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5640

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe
1⤵
PID:5856
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe
  2⤵
  PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5612
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe"
      4⤵
      Views/modifies file attributes
      PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5784

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe
1⤵
PID:1208
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uyq1rg8y\8dkx19ox.exe
  2⤵
  PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5656
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe"
      4⤵
      Views/modifies file attributes
      PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6264

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe
1⤵
PID:6476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pfh4ykx0\j350a0wq.exe
  2⤵
  PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6836
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe"
      4⤵
      Views/modifies file attributes
      PID:6896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6744

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe
1⤵
PID:6276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oxi5c2bc\jc0lp9px.exe
  2⤵
  PID:6592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6716
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe"
      4⤵
      Views/modifies file attributes
      PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe
1⤵
PID:7020
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\drk11yof\ll8qntj5.exe
  2⤵
  PID:6432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe"
      4⤵
      Views/modifies file attributes
      PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6992

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe
1⤵
PID:7092
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\26iyu144\ush9ssb6.exe
  2⤵
  PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe"
      4⤵
      Views/modifies file attributes
      PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6844

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe
1⤵
PID:7044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u2k7hqdp\y8s4g7vr.exe
  2⤵
  PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe"
      4⤵
      Views/modifies file attributes
      PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe
1⤵
PID:7132
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xw4rqhjq\59cin117.exe
  2⤵
  PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe"
      4⤵
      Views/modifies file attributes
      PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5776

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe
1⤵
PID:6252
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p3utqvdf\frf7cbkk.exe
  2⤵
  PID:6888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7036
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe"
      4⤵
      Views/modifies file attributes
      PID:6192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6944

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe
1⤵
PID:7000
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\62yr9z9y\n5eihnis.exe
  2⤵
  PID:2128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4668
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe"
      4⤵
      Views/modifies file attributes
      PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3184

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe
1⤵
PID:6652
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjzn472u\l64xbvw2.exe
  2⤵
  PID:6636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe"
      4⤵
      Views/modifies file attributes
      PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe
1⤵
PID:7528
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\erd4cyb4\z5l4mwzh.exe
  2⤵
  PID:7628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7864
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe"
      4⤵
      Views/modifies file attributes
      PID:8088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7432

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe
1⤵
PID:7436
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\33vy4g3f\2lk9t1nh.exe
  2⤵
  PID:8160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00001e
Size 280KB
SHA256 116caf093749c2e465d1de3576c079ebcf73cdd51283000054e82218cde88569
MD5 cadeb452f59265a41c0faa94b574fc53
SHA1 701cb7cc4374f0e6b766ae145c16d12e2b229a86
SHA512 69f242eb2ebe3ee8387795d02f5f1ea4e586431949fff3bc3423f0bf7e1e27c6704e364c5b80c499275118951d3bc8fc01ffc676d7ec25bbc54627df5a78b531
SSDEEP 6144:zZAlMSb7e+BnnR9VEOfFoD9DA0dzIjHMolQKdKX:14MSb7e+BnnPVEOiDy0yjH6X
TLSH
T17C54229610CBBF7AFC380E7D1CDF82A551327658579C8EC0E52A061846BEE98E3C6971
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00001f
Size 75KB
SHA256 70481b0a5b12b63fdad6bce7bd16a8f22348f8a7332ae21b6639280be4e5b7c8
MD5 d7e3cc2aedb2e4a9ba47edee17ce4f31
SHA1 8fa4b8839732d36ee65d3ebfbf49411d75906b61
SHA512 277dd598e54aa6d060b35b14f52bf1c50639b5a3d0580e84e28ab12c7eeeae75a87510a3e339de5e34edf92da8cdc56a09260d0ce48caf62aa95e69bd87da08b
SSDEEP 1536:ZCLZNvxLOKvR6UVftorPTzn/CTejijP0+tebo9xGSp0i1B0SlldOf:kLHgvQFaTznqTMm0SWorjt1rcf
TLSH
T1F17302C88FBB3931A895B4644206BF07C47577BAD85A47F988A0DFA0F4477085E54B87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000026
Size 219KB
SHA256 c07be632f6dcab1101aa6daa050cd62f268880f299f25ddfefeed467294184ca
MD5 61ee8bd0e7b1637ab9d8f12685bbdf85
SHA1 71e638faf6fd43de95701e036b8db5dabf1fdd13
SHA512 1269070d88c2b8396ceb626210e43121e1542ae6fe811c70899bd64c3626025aa612cbf6b3676b1ab294c3fe0470c472567e1233fa54b4ba8777ef737db803be
SSDEEP 3072:nbz9barNmH8WBBJkDTSo1dYyVReG2L32QHk6jWszrSZUaKpseDEzXpa48dMvkrir:bzsBIS3R1PzeGe3M6HuZeOepMvkXJm/9
TLSH
T1F22412E1C4759BF09B374EF3C1B0BDF5A35FE3205C9E46A5BE841E0AE21082438A5A75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000027
Size 280KB
SHA256 c01b1d80e64d36c37014cbedc15ccdcf20e826e07cfdaa2094c6d4e470d2c3b4
MD5 e41b573b17e43967fe3e55c14d5dfe85
SHA1 459afe1e3faf34a5a4698bfb602961f1f296ead7
SHA512 f769ac941ae6ba94b361a03c8c3796f3b811d5a0e4c2aacfc23ebc1ee767daf6d5fadbae4c4d27928d59f5daaa5daee91358b0caf9469e1438ee2786e8a46741
SSDEEP 6144:amiJ2UKW82ExgTbtMXV5WlYdI/CsUcBrRmlwrqfQ+XealtgaO:aALWqxGyV5WlOI2cXmlwG4oeagR
TLSH
T12D5423720D90C077A60628E96F8426B0F119E6C17C52D8DAF1EBD4D035ABCD7E678B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b855f07d3ec1fc1d6666b13f9cc55eb9514adf00fe98d97a6ca6f54f238b023e
MD5 794c0a1de449b33f8896e0ad20e407fb
SHA1 1860b303104c8ba37c6d3de217587aec328c2986
SHA512 d413c9d7ef8d77b2ca5c43f01997bb9e03a7e4e44531a646df5a419751072bec71f2bce63c29ff575f6470b85c7b08dc96889d1739abde3e6589ff9b831fcff9
TLSH
T108313F2C4B781EC2CB99A5B6ABD2433A32F89E6F02C72F600E826E706DF0F5410D1453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a994.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a994.TMP
Size 1KB
SHA256 5923a16a5a61b19d8e069f1825270e03729501fd468aa848ba5c5362774c543f
MD5 939641c6cd3057671e59e6e7c1d04dd5
SHA1 36834b41a0013a9f3e2653abe5b62bc9d3419d3f
SHA512 9084f104e8141fa0bbcc52bf05c7837ec9a89b824243dadab6bcd1d54339e2b8a3e809497968b8265fd040fa2f1cc169e9f9651b24e81ef6738d114938e58bb1
TLSH
T1DD21EB6807281ED3DFA155B2AFD1466E72F9ACAF02C72F900C45AD30ADF1F9460D1043
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a564d895bdb6e676e611d4da0769de3bcb075e31247e94b013746fcf8f6c43a6
MD5 f6817e37d55875206b0ab2bee5246ed7
SHA1 f4176d638ef07d7d396abe367581ebbe87de6f16
SHA512 c7e179a42632a6637df6b99b6e9c7adf93c4b95d1ff24140b731de2c797f2c82a3e926836d9a6fbbe48fef5998e280755d76ce3b6e460d60bb0e80298110c9ff
SSDEEP 192:sxRdRnyM/jK1Ml8wCP/fqst2pq1zeizoD8pK/MXFEFlHg6+WNsRRdcdZYBQGckkz:sxRdd8P/fqst24KeaD5M2ZMcHY4
TLSH
T1C162F856A6349A778CDBD208F951BB57D3F94133A6901E44AAFCCE0C04E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 11ee277341a281ea6ae617341699db5a3dc8d26f024cb5fe33953cd90b0da141
MD5 40cc3b39b495b52913614bc76ff1b391
SHA1 cd543f23d80b5b62abd8fba333488d30b1a4cfc4
SHA512 965a1655d640c9b54ef7cdb8f2648a8c86a3f4d3bd396df462c1cc75bb1bf74e7778323a189189e72f1e8232cff10e9defd54cab0abbc02244e2895cbe66499d
SSDEEP 192:sxRuRnyM/jK1Ml8wCP/fqsD2pq1zgizoD8pK+DXFEFlHg6+WNsRRF1OdcdZYBQ/N:sxRud8P/fqsD24cewD5MC2ZcHY7
TLSH
T1A172F856A6349A779CDBD209F951BB67D3F9413396901E44AAFCCE0C04E6AED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 80801411e4daae727246c1a506add077a6c12097c5361d65b138a93241a14128
MD5 123efb13c085bba23a1a4940ba67def2
SHA1 a43b97b0eb971621bfc48130b4071cfdaa2cdbc4
SHA512 1c612351afcde8a8d6f441c0ffed7bdacb591890e19f645cc5260b72bea798ba660b36e27a2d3f514874e3adeba394896c3e8f3640dee865dd3eaa132ef52c88
SSDEEP 768:Utiij37pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2pN05roYEU:UtiijxE7ANWgv7fgJu1jaBf0yVU
TLSH
T1BBE20C7B680CCB7E4F804A9DEC29BD9B6DD801CB56D8CD9447EA880C03C67EB551A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3d1c16ddce67e84c9c849bc57730dd607c7e02f260ab6878fce47dbc7568964f
MD5 8b1d656105c67b6594dd98b2e3c484df
SHA1 cf8ed267b20337c2d333c6bd56e45f96e0c9124c
SHA512 a32188a71f719d970a12ad472a23d7649a53c82004baee22f8d24a27569e75add1f355d5a2614bd8e747f1dce67a69888732b4dbbba1d5c86b3c271ab9ce6c25
SSDEEP 192:Cm7KmgIIJ4tWGm7g09OGlkEfEIEtEpEfEdE9EcEJEmEtERE7E4gE/EeEnEvEOER6:MUg1g
TLSH
T109D12B45753F02D1393EAA0891BD8C2F91C174A7306CA46B7BA911651F6BF03ADFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8b0a43cacceaa25c196727798f8c8aaff1413b655815395e6d97c9d9f2e03b81
MD5 c83e44668ce8df14c0e8885042ee0461
SHA1 cdcdb61cae942e2a751db5baa675fde6090afb65
SHA512 7c59c7bbb65c4bdff0fe8569b22a6fac8a980bf73aae66c9e5029db57c31548fd2f6079123665463dfac0b7daf0058ea7372c677f914589ca564f3afbdb0fda0
SSDEEP 768:xGrv+4UNbdS38BPlYy7x87Hucys6BRvi82oP4/z6himo+82bwn+h:xGbsbw38Rx53imOz6Imob0w+
TLSH
T18703C035F4549972EDEBC188B44A7A533FF4522345C91AC0E6DE6F0E029B95E630BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8691578644d556ea07ba18c3a8224b684fc48d90d5ba71ac04b3fa995f9bd91d
MD5 716cd807bf25fb1016e5c05cdaedecd0
SHA1 0dacc2207a50eb0451fa004d155e9c6dc9bbfc79
SHA512 274bb55160e2078931a93d1a97b06e4d4faa99181bb34bb75700275280407df17e0afacda5d1046319f78f81717b55a81b4dae8b1bb316b60caea7c7c8b3d274
SSDEEP 768:frv+4UNbdS3GLlYy7x37Hucys6BRvi82oP4/z6himofH2bwn+h:fbsbw36xW3imOz6Imov0w+
TLSH
T10E03B035E4599D32DDEBD188B04A7B937FF4626349C90E90E6D99B0E0187A5F230BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0ac068459251d66f29dae7acaf0db08cd12a73e77269ffba2e33b7d4e4c0aa0f
MD5 891a17f054b1cf53a9f78faaa5af6f0d
SHA1 87c596704ef26b5b205bcbc3e5165ac2f2dd483a
SHA512 275bb632fefec25d912586a6c8ef285263eebd5ed33cc791fce5967eca55d45b1de809b16e1eb77a1d77c138d20bb6e314b3e7940db3d3c44374dd7a677c3c92
SSDEEP 768:yr3QJJlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yr3axy3imOz6ImokP9
TLSH
T148F2BF70E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6cbfc1c86be97207c848dd9daac7b5b4790772155156b8ee33a607342e9780f7
MD5 1f729946bde0e2c39b2ec7dd4ffee587
SHA1 ef54578f9e2f28106641ac7ab3a6a1118cecce2f
SHA512 d007b46f3a629740ba19ae4db58d7788bde663e3088a5d2a0d6ece7adf028bed1c24ef3cb08764aeff733e60dcf4fb5c8aa5bca997738813617b1777a17c28cd
SSDEEP 768:yi3Q+xlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yi3Nxy3imOz6ImokP9
TLSH
T160F2BF70E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3A6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 070a22945c9186542855504a8a2f7cd3522f9f9936f9603718a185753576217e
MD5 ff49d12448feb1f12d79a905a5504a85
SHA1 bb686f9d37212e79da16a9c30feaf9293aa228f2
SHA512 c4ec3400b76d2b67310dfd38f7e4db08f8b2d4a2b07d3f555fbf63ec40671b21adedeb4911950f45eec493e37a6c5aa092c9dc2fded0f332927a414712314f6b
SSDEEP 768:ye3pwDlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:ye3Cxy3imOz6ImokP9
TLSH
T121F2BF70E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 28570c2dd48a927fc725227678e71560b5a18db1557051fc49ca60cd2cdd3272
MD5 c13ceca875db8d1091011c32c4193f75
SHA1 304fb8dcdb003d5dc9a931e5c6f159f13bd8c8a0
SHA512 6f872650dffc4db80992bfcf52e79fc0d9d8e154dd7069c415b171f7dede44bbb71ef1ab4c72452fdcc81c4fceb4977f2b24eb110e176fecf5f26213206a1e09
SSDEEP 768:LD3pSblYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:LD3Exy3imOz6ImokP9
TLSH
T1D9F2BF70E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1c34c6888d54351fd6d3074c4b00b91540dbbd2f5572d48c366003eb04cf6795
MD5 b5a75647ffcac71f3aee68ad022d732d
SHA1 e4e62bfc7d7f7d3dd2557beb2e92545bdd0f9420
SHA512 14eff684aa338f5bc4595c79b96327880aa29bb69f2ae5569028fd39e89876c83786875a3cecf08a08ba429883d1e12fa8cbdddde26b48c4e6a9fb4df27fa40e
SSDEEP 768:yk3QkTlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yk3Rxy3imOz6ImokP9
TLSH
T198F2BF70E8559D62DCEBD2C9B54637836FE4623395C81E94EAE9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3a35f3d20f973eeabcf5ddbfe7a24d3ff8eebdf28b8c79e7d226f6307f5b7dd7
MD5 f8b5496fbd120cc1f4d7833d0737a2ba
SHA1 b39530822a0ec85f1f365ae536c944fba17e167f
SHA512 fd77c3fb7a79b03dfd24049cd451578ecef771294f40767db15eec66f8c0d98af45b2d6913aee3bd705bc92e295716e53e778f45686a7f46c7787f9a1676556a
SSDEEP 768:yU3QD1lYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yU3cxy3imOz6ImokP9
TLSH
T183F2BF70E8559D62DCEBD2C9A54637837FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e1a0dd3b111b1973b962468e1b7d2ff3917b31b8bbf912c3727edba55c4d57c
MD5 31a3d908a24e4ebd5f243fd03f1ec2af
SHA1 0ac1dba5953881586170f55914b1f701135f19b7
SHA512 eaa370bd2e322aa7038dcb9d1b4218418654076c284e0d53bd28e0ce7731b459c4e85689171d680e710cfdbb35a23a6f368d79422d4a09b0d1010490f6dd9195
SSDEEP 768:yo3QdZlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yo3qxy3imOz6ImokP9
TLSH
T170F2BF70E8559D62DCEBD2C9A54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f72ef7070418ef1d486987f26ef782081ef188601e98a9186ce213bca96222af
MD5 00d45bf312fec45363613e9d24d8fb6f
SHA1 e60ad3d3a6c430a57d10f7aff6a52b237b084dc8
SHA512 bd1e4fffceadaa16a7f2e4ff11c5022b2970c05177de2db8e56428db25adc0992ef371745f7338ab194d098f51833abfc9d77b65d32327fc7686f0b3c87233b8
SSDEEP 768:yS3QeblYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yS3bxy3imOz6ImokP9
TLSH
T18BF2BF70E8559D62DCEBD2C9A54637836FF4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4edffe2ff6377ba6de0d0e80fbf76b31acd37d7c15ceaf0b42ec15b143eb5769
MD5 0311e14aec411686ed6957cc89250323
SHA1 6c8b1566e6ee896cf079496c682a7270d1b47aca
SHA512 0eeca319aa04066a0d2139e5f4c736d25f45a735f41e058ade2b7e8dc8ea155e2f67e6dae00bd7140d218b705353df5cc5b82bba05556e78fe20bfe624e94416
SSDEEP 768:yk3Q33lYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:yk3Ixy3imOz6ImokP9
TLSH
T13BF2B070E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 94f6ce168bd3f73cefbf7f896ff5e8b17cace6d77c11679539750adfd71b3061
MD5 90f046721b3c791b096755e3d285e58f
SHA1 4aba703b59c3a3b0a72aadf26c72df24f1070fca
SHA512 54e6b6fd0a886b4bf3a6590853647edcfd389d3d333dd5b69cd87543d42811b4115ad2c2bb89d78ea36a61f20c50e1a16d65cfa7aed9b610197a15d918a2eb36
SSDEEP 768:6rv+4UNbda3KIhlYy7x77Hucys6BRvi82oP4/z6himo6HE:6bsbA3lxy3imOz6ImokE
TLSH
T12C03AF30F8599D72DCE7D285B04A7A937FE4226349C91D90EAD59B0D06C7AAE170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5081583266526665817a65ba423be8a389e1345f6759cca8029fbbcc03600291
MD5 3d9e75f5799340f1ec07850ea95d6779
SHA1 fbe7cdf69c63cb689746fbdd0384a9928b2c0edf
SHA512 e812279b2cf9bdd6457d71b77ac6cfe33fd2c63aa114b5c5375a4536c6649a13405bca7b7405bc6e28186929873a9fc70e1f7c5adaec8ba0f199be472bf2b2bb
SSDEEP 768:erv+4UNbda3QSblYy7x77Hucys6BRvi82oP4/z6himo6HE:ebsbA3Hxy3imOz6ImokE
TLSH
T1A303AF30F8599D73DCE7D185B04A7A937FE4226349C81D90EAD59B4D06C7AAE170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 67639b27fb7d6aa1f907d80735461af580acf362ae5d9aa7349314fd85ee1312
MD5 12351c101bbc88388c92faae4bca3153
SHA1 9697f091ff1a3c1818996476d7303e244e0fd6ba
SHA512 fb895f90cb08297fb1e323c9b78067ac60ea6d2d3d05d80e099137cf82b8438041518f73d497650af397f6de4e8bbe89a9e427f548df77d7b2960d145339cebe
SSDEEP 768:Le3p+XlYy7x77Hucys6BRvi82oP4/z6himo6HPi9Pq:Le3Yxy3imOz6ImokP9
TLSH
T142F2BF70E8559D62DCEBD2C9B54637836FE4623399C81E94E6E9DB0D05C3B6E070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ba68742e1cbf665a5bdda94e6d1289ddfa15ea8630771863a8379a95d8cdc494
MD5 6da587e46d16cac72b0284a137727e6d
SHA1 633d2cfae6a5c0c5fc3d87c981434eb993de3449
SHA512 224cd8d1c744f06a1885ecf37ba43925b9fc8005046b2476199047f671e03be6d3b03c25614b0b909fb542e7d3eca690b4c0f5ad14a4e9abf8cf88480878b234
SSDEEP 768:Irv+4UNbdS3cFlYy7x37Hucys6BRvi82oP4/z6himo6H2bwn+a:Ibsbw3+xW3imOz6Imok0wJ
TLSH
T16B03B035F4599D32DDEBD188B04A7B937FF4626348C90E90E6D99B0E0187A5E230BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d51c4982-ef09-40a8-9143-0d2c509b8249.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d51c4982-ef09-40a8-9143-0d2c509b8249.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\base_library.zip
Size 711KB
SHA256 798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6
MD5 05d0908ee6fa68c754467fd809f1d9c7
SHA1 cd98cf488daa557e2209fdeb9854567cc0caf784
SHA512 898481b2da12d3394b716f2bdafe025ca8c5a6c8ed2b0e5059dbc32518867c34264a8b53be1f46fd62bcc29e57348169d61a06b7dadd8bd0784ba661a1614d98
SSDEEP 12288:M82osQNRs54PK4I1/k11Eddc4axDfyEDV0cJaoQDSQhmu:D2osQNRs54PK4I1/7dC4sDfyEDV0cJaj
TLSH
T171F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI41322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dpem3yw.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43ccw80u\0dpem3yw.exe
Size 5.4MB
SHA256 d30e1a2ee82fd800a2987f54615b26f5a8cfb4f46470c9fc89e0fb97c52cfd5c
MD5 6912d1370c9077fc61588321b76a036f
SHA1 81d679683990e947ae92a620bd5d0e614d67eb50
SHA512 a0b4a07baed37789be8c9b8a16c90e651880bb8e03edc69526e9d48535f3edd0d4967ec3cfa2a440a769348a8b02f24ff4a000ba76915fcd13e3bf81aab5ceef
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNH:GHICteErownP0oTcMsABql4Ut1
TLSH
T1F2463348B3E809E1F9B3E03D81565221D972B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads