bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468

Analysis

max time kernel
59s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
Size 5.4MB
Sample260818-ebnlhsdp61
SHA256 bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468
MD5 94ff2a21bf5afc4e12005f107ef96eeb
SHA1 d72aef180fd50765716ee78bac5d87cb40760f99
SHA512 28ed0e4f4b15cce7bbe23ca3a3726495258a6e1acbaa2a52008e9334a3bacc831eeaecb6a707c795fe990074b1600d0c135e3562ae11dd2f2af1e70055ae5f3f
SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6to6:GiiICteErownP0oTcMsABqlAuctl
TLSH
T16B463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1206
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2379
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8374
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6083
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7215
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7927
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8040
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6372
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4484
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6580
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3028
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8445
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1335
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1145
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5029
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9508
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5731
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7830
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6556
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7107
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1929
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2149
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6093
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9443
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9309
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6276

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5174
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8048
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtwovc.exe	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mtwovc.exe	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe

Loads dropped DLL 11 IoCs

pid	Process
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\tc6tpl1q\\gkt5i7wx.exe"	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
559	ifconfig.me
1868	ifconfig.me
2755	ifconfig.me
44	ifconfig.me
76	ifconfig.me
426	ifconfig.me
1118	ifconfig.me
1178	ifconfig.me
1947	ifconfig.me
100	ifconfig.me
153	ifconfig.me
261	ifconfig.me
392	ifconfig.me
157	ifconfig.me
356	ifconfig.me
892	ifconfig.me
893	ifconfig.me
1853	ifconfig.me
1909	ifconfig.me
2591	ifconfig.me
389	ifconfig.me
452	ifconfig.me
643	ifconfig.me
699	ifconfig.me
2162	ifconfig.me
659	ifconfig.me
2091	ifconfig.me
2309	ifconfig.me
2372	ifconfig.me
2630	ifconfig.me
2944	ifconfig.me
460	ifconfig.me
598	ifconfig.me
796	ifconfig.me
1340	ifconfig.me
1457	ifconfig.me
2865	ifconfig.me
269	ifconfig.me
315	ifconfig.me
417	ifconfig.me
984	ifconfig.me
2258	ifconfig.me
2560	ifconfig.me
46	ifconfig.me
129	ifconfig.me
264	ifconfig.me
271	ifconfig.me
344	ifconfig.me
1508	ifconfig.me
1537	ifconfig.me
1772	ifconfig.me
236	ifconfig.me
895	ifconfig.me
1671	ifconfig.me
1838	ifconfig.me
2053	ifconfig.me
2651	ifconfig.me
179	ifconfig.me
294	ifconfig.me
433	ifconfig.me
874	ifconfig.me
1134	ifconfig.me
1386	ifconfig.me
2214	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1884	cmd.exe
6432	cmd.exe
6476	cmd.exe
7088	cmd.exe
7752	cmd.exe
7348	cmd.exe
1808	cmd.exe
5892	cmd.exe
3796	cmd.exe
1744	cmd.exe
7328	cmd.exe
8684	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4488	msedge.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 3680	5880	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe	89
PID 3680 wrote to memory of 1808	3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe	90
PID 1808 wrote to memory of 5556	1808	cmd.exe	92
PID 3680 wrote to memory of 4488	3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe	93
PID 3680 wrote to memory of 2500	3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe	94
PID 4488 wrote to memory of 2108	4488	msedge.exe	95
PID 4488 wrote to memory of 1468	4488	msedge.exe	96
PID 4488 wrote to memory of 4504	4488	msedge.exe	97
PID 4488 wrote to memory of 4504	4488	msedge.exe	97
PID 4488 wrote to memory of 4504	4488	msedge.exe	97
PID 3680 wrote to memory of 412	3680	bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe	147
PID 4488 wrote to memory of 6004	4488	msedge.exe	100
PID 4488 wrote to memory of 6004	4488	msedge.exe	100
PID 4488 wrote to memory of 5860	4488	msedge.exe	102
PID 4488 wrote to memory of 5860	4488	msedge.exe	102
PID 4488 wrote to memory of 5860	4488	msedge.exe	102
PID 4488 wrote to memory of 2588	4488	msedge.exe	103
PID 4488 wrote to memory of 2588	4488	msedge.exe	103
PID 4488 wrote to memory of 2588	4488	msedge.exe	103

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1832	attrib.exe
7804	attrib.exe
7392	attrib.exe
3204	attrib.exe
5828	attrib.exe
7368	attrib.exe
8920	attrib.exe
5556	attrib.exe
4496	attrib.exe
1180	attrib.exe
4200	attrib.exe
6484	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
"C:\Users\Admin\AppData\Local\Temp\bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Temp\bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe
  "C:\Users\Admin\AppData\Local\Temp\bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe"
      4⤵
      Views/modifies file attributes
      PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffe97e8c188,0x7ffe97e8c194,0x7ffe97e8c1a0
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,4798392388693173363,5780731842267015834,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
      4⤵
      System Time Discovery
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,7053229367804429540,15786861046851274727,262144 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2744,i,5385257654489958166,7132643700690428864,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:13
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,2397419847699376427,9116574830646804401,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,6568070404112641658,12645721046328418616,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10301508448686562888,16826192703766070062,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,13427633646560069404,9845423583457155777,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4344,i,5023720324140121265,13367412119560265905,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3676,i,18273791390415520049,671046799110344159,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5540,i,7667024945216240756,11756215146256357813,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5784,i,5053612597736249820,14459766500287364704,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,13046541256128332030,282774073583004773,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6132,i,15607481919983978666,15935883535682083488,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3952,i,7698909029834292472,17645180546555597349,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9518547479717028640,1893327634239303195,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,17079116152957753947,9327618636579364717,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5652,i,717078861569222347,14243953963760017709,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5712,i,9437845476201163657,10463264776771713276,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6900,i,12256443253227389493,8552778503511159876,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7076,i,6463961522735487797,11798080535022894895,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7308,i,13287576668061429417,4868392483745528885,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:1
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7496,i,9088171391129100475,13377835929381415997,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7680,i,14301961151581398902,4886237289665266198,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,3075070429299393979,2022709135479782352,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:14
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,3075070429299393979,2022709135479782352,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8340,i,13137912481345432154,2714482211261465699,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
      4⤵
      PID:6540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,11655175316256370503,15083030859250375180,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:12
      4⤵
      PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8432,i,2592621824297770345,3962010524184393028,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8392,i,11808753523534486314,13965103070471777409,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
      4⤵
      PID:6556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8360,i,13768985908165551449,13886736465654143794,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8512,i,12143348758511270306,14382174126933334987,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8444,i,5999327250163652949,18208747903816936725,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8500,i,13000171199380495805,8884213065869881979,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
      4⤵
      PID:6604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8760,i,6815733909244676819,12145972473279627003,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8892 /prefetch:1
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8748,i,9929447852060278253,12660119562572668519,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9028,i,15393504670927716394,8365863409742352686,524288 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:14
      4⤵
      PID:6620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8784,i,11803223529391073551,4350918194646882005,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8964 /prefetch:1
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8880,i,14795703186602081751,1782115637593595960,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8884,i,18183821136808797171,6947359294590934644,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:1
      4⤵
      PID:6644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8700,i,18098392040490794662,6401981891558684670,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:6628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8836,i,1260961332945894568,4535157593008220372,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
      4⤵
      PID:6660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9392,i,5746439870874460881,406675159096076735,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9368,i,5710228681262501683,9481343334587676370,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
      4⤵
      PID:6684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9480,i,8470300745500965318,11889504552051120157,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:1
      4⤵
      PID:6692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=9308,i,17258152037390459180,14229700224501786104,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:1
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9416,i,7261174618056024802,5114973956169320043,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
      4⤵
      PID:6676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8920,i,978147506970044222,18047627306430927564,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:1
      4⤵
      PID:6716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9336,i,2830018399267761018,7136986728176826090,2097152 --field-trial-handle=2100,i,13571057853542072469,16871766195406565961,262144 --variations-seed-version --mojo-platform-channel-handle=8604 /prefetch:1
      4⤵
      PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2368

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe
1⤵
PID:5600
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe
  2⤵
  PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1884
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe"
      4⤵
      Views/modifies file attributes
      PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5892

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe
1⤵
PID:1580
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wc471dm\0rtojnyd.exe
  2⤵
  PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5892
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe"
      4⤵
      Views/modifies file attributes
      PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:412

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe
1⤵
PID:1112
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o7l3qc3t\3s6k8q2g.exe
  2⤵
  PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe"
      4⤵
      Views/modifies file attributes
      PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2180

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe
1⤵
PID:2796
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tqhsm8x0\i8fr4ldh.exe
  2⤵
  PID:4336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1744
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe"
      4⤵
      Views/modifies file attributes
      PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2304

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe
1⤵
PID:6316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\txwcdixy\zkde8evm.exe
  2⤵
  PID:6396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6432
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe"
      4⤵
      Views/modifies file attributes
      PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7092

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe
1⤵
PID:6424
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aqkdqw6k\jc1zvwdu.exe
  2⤵
  PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6476
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe"
      4⤵
      Views/modifies file attributes
      PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6928

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe
1⤵
PID:2376
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\djyap6fq\p27v20eb.exe
  2⤵
  PID:6892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe"
      4⤵
      Views/modifies file attributes
      PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7488

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe
1⤵
PID:7504
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mng943w9\cf2efglp.exe
  2⤵
  PID:7616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7752
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe"
      4⤵
      Views/modifies file attributes
      PID:7804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8120

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe
1⤵
PID:8152
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ctpdnv26\csmlx1lu.exe
  2⤵
  PID:7216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe"
      4⤵
      Views/modifies file attributes
      PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7784

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe
1⤵
PID:7956
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1xmbzmwe\63d7swbo.exe
  2⤵
  PID:8100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7348
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe"
      4⤵
      Views/modifies file attributes
      PID:7368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe
1⤵
PID:7992
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3i8bj5gg\fpuv7p8w.exe
  2⤵
  PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\unitp7kt\akap7oty.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\unitp7kt\akap7oty.exe"
      4⤵
      Views/modifies file attributes
      PID:8920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47208f91-7dcd-4cc9-9fff-2192a9e6568e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47208f91-7dcd-4cc9-9fff-2192a9e6568e.tmp
Size 40KB
SHA256 1a1737fa26b72e03645e88296d8b672e1b86362cff3f15833789b8451d062741
MD5 1be4fe4ff6b4d8e16386bce4c84f616d
SHA1 3548c4cbac926f32d144c371c809b3b983abe58c
SHA512 c5f8e06cb98b0e5d343dd2843a58ab16c1013a8d26d06c3881a14677126b50638cd31c102eae8fbc55787ff8c84c2d867b134ff5ad50d1a5170763ffe554d69e
SSDEEP 768:Wrv+4UNbdG33M3DTd+ZL7beX6+qTko0u229a4vsSRUeVH1SdW:WbsbU39L7KvVTVKa4wEH1h
TLSH
T18A03CF32E8698D3389E7D6887147768B2FB92173CAC40F54D8EDAB4D054B59C270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 280KB
SHA256 c795e86e2182ca03afca58492c60a52b8b6ae812b95f2d477d9c9469747be3a0
MD5 1ed8514100eb8b5c63cdeb7cda1331f8
SHA1 5be771ba173951086ffc9aa3cda212b54cf9a299
SHA512 17e90877d943b3fa20c0da4d7ed1d7daeec4ad0f2e093448dc7c281f739a84adfdf880b384e7f8e6a3c21509f6f0bff95e473a06ed7d1ced52d02191b45b8bd6
SSDEEP 6144:5jlaR+FeUbuFjgHBWQkmJOKWrSIp1g9LTMD4Inf3W7:b+EbusBzk4OnSIpy9fIVf3o
TLSH
T18C54227DFADE93A079A147861ADFCE81D0BEFCC2956EF84BA6184539171F9C0CC69810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 205KB
SHA256 e74a551475ca3c977a6a9c6c3adf6c9a0835fb0649ab70facf1c84796a04ec64
MD5 400a127552ccd757a7d1b122b1433497
SHA1 11211398d64a6b65af38575e045663c8e1b995ce
SHA512 d9ce468822d0d0f02a1fd50cccc0badbb8d490929ed5662e9e9cf1e7015aa9c7f2cf1652d9a5608aa817b5d77f8076a3a4ece83c2f43b35d85997dbd7b87c2fc
SSDEEP 6144:bj8NBNT44hUIswJ7VVG4ZXXePeq+DQLLX9CJITmTENK/VrgzxLh:bANB544byonZ9DQLX9bTm+6g/
TLSH
T16724121588210F27A1FE2A9C51AA7DFCD395483C3C0AC5D0A2EF5487100FF5C9ADBE59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 740ac77540deace6ed8ea2103e567bdcd7d21e459e656b498734020aeda9d43b
MD5 444711653235e0122e1a4fa53193fe48
SHA1 35fccfe2a9a9b4b2601c6cc470328018edce5d5b
SHA512 c8b1a31e3ab594f6e854681ab478fa20148a4a214c69099368b72e3231900f18ac7f781c3120ba72ab46b4019be7ba38f778777fb44b6ad2678bade9cf11a1ec
TLSH
T16A81EB63E3962AD5DF998A77B3D1DC76F2F24059010F2B1AD850AF704456F925CF6203
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c1df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c1df.TMP
Size 3KB
SHA256 ceda421e18f2aa6a4fdab15a0983c789258bfc22fa55fa0830c48ce3aff42e22
MD5 7c12c5a3d3e1601b707e26682e285ad5
SHA1 995a1e7d8536be17414da458f96affaca2f21d1a
SHA512 98abc16a41f03d3abf47104f82938a6275d3d12b3a990d9a61f24908d913648e93e734c938c51a85ffded7d4724b4750e1dfacbe9a251fcefaf5d0fb7bb3ff64
TLSH
T1F261CA53E3922AD5EFA54AB7B3D1CC7AB6F24458050F2F1AD884AF704465FD06CE6213
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c2e3ac64c256b239563fe4ff27cc0579da70a000685c63270adde0ae4b118253
MD5 2d92670ad6e76e4b09f910c6d50e6478
SHA1 4fa0ce98929f5749f275cc3c5171409e4e4ea5c9
SHA512 e6bffb085983054eb3a1789c481bb8ee9245d3feaaf2d90b7e3bf26547f7711dbdea18687c9236514e4b0a16d4ec7cee3af62998fdab3709c239e881b3ab4f51
SSDEEP 192:sxR8RqCV/fNsfjYCbxzoA8pMNUFQHg6+WN2DG1xCH/YBH/A/3bGcPIgVLuJ:sxR8/V/fNsfjPs7a5Ji/uCBI
TLSH
T19C42C8166928AE3B5CD7E21DFA15BF53D7F92422A1D11E48EBFC8A1C10E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c554dc08bb453aaf0084ac6b08f9834f00780488f31dca87610142ef5b1bd018
MD5 79ebb837208880ee8ca7d4492d0eb0c1
SHA1 182527f28bca96bb223955ec7259dbca554e23d4
SHA512 6deb0de7bdd29136960d2ca0921629779eda7b987b7334354740f4a69edf6f8bcfb9daa8990560b3e4ac2751dd58ace866325a9802416a35167de73c2a1e34fa
SSDEEP 192:sxRTRqCV/fNsQjYCbyzoA8pMhxFQHg6+WNssuFdSdzRJCH/YBHfxH3bGcPIgDbLe:sxRT/V/fNsQjP/2a5SarK/CBq
TLSH
T1F152C8066928AE374CEBE21DFA15BB63E7F5142291D11F48EBFC8A1C10E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dec62ed5deab286833d1a6d94b393faf11c5a7397843787507a7f81ccb6d81ff
MD5 bc45d0f917514e4f9c85123eb689c68c
SHA1 e08555265bef36f80505f091b66a486f71ef7524
SHA512 fec56db075ff7f60004618bd0046ac26fb582cf09f7b099c2e1cf7ebe4bf0506a7d35c2c9c67c87c52c3f7bfff5214253fe044543958cc75f7f29a8ef4f0cacf
SSDEEP 192:sxRTRqCV/fNsQjYCbYzoA8pMxxFQHg6+WNssuF5m9zRJCH/YBHc/3bGcPIgDbLCJ:sxRT/V/fNsQjPhya5S+LK//Bq
TLSH
T16652D9166928AE774CEBE21DFA15BB53D7F5242291D01F48BAFC8A1C10E76ED620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4af67d947456a6b5a16d38ee55aba8989edda72172aa6399d17988c9d46ca4d1
MD5 56fcce9477bdad97d315a314cd52c505
SHA1 e13f89fce0c8791202be7018d384105e0cb43448
SHA512 d12d96e9f9c903672e06b58ae2c3fcceb82eb66bb6e556b4c278f5b2e9d35aeb378cd47998a6423880e001b41f737543652971bd7945bb6d79d9ae9f8330b81b
SSDEEP 768:40Dk6DJQD8dF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/N:40Dk6DJQD8dTE7N0DbWgQ6DjfIQDFu1X
TLSH
T137C2D97B640CCB7F4F804ADDAD197A8B6D6802CB96D8C98047FE991C02C7BEE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9feca2ddec968b1107617e4453477792fdeb0fdefee8c644304d7d24cb6a398a
MD5 44198c631682b03d74e3c995665dec37
SHA1 7a77d828fb7945d512e49af128be3e90694a9af9
SHA512 2c959183c22932e22d1e38f78fbf4067e0257898ff354e5916a10d4794c68c0891bfd7c03b26ee33ded2129bdaf8ae28773e4aa2bbe5835b13f6e7626bb605b3
SSDEEP 768:prv+4UNbdG321DDTd+ZLLeX6+qTko0u229a4vsDWeVH1SdW:pbsbU3VL6vVTVKa4XEH1h
TLSH
T10303CF32E8658D778CE6D688714B75472FB96163CBC80B80D9ED6F0D065B5AC230BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 f25145f107525916469aa566fd8bfd4ec9ddb5a136b07eddc350c7ec71a9b6f2
MD5 740dbbf1e565dbef327b742bfd932282
SHA1 feb0e3f0a66c18e477416987caf2691dc345cee5
SHA512 2f62273670906aa4e2cff84899b0649aff88d4a584481bdbae4da41af449f6609299d57e3f514da21f9e610b541ad82b0731e98695f1b99787cae847d771d538
SSDEEP 768:YAs3iXhDTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:YAs3nL7JvVTVKa4v0cHsBp
TLSH
T1A0F2C071FC118C73C8ABE2897657368B5EB46173C6D85E44C9EDAB0D014766C270B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6e5f05ca63727d96d297a14bf7e205efe4775c3781d85cc1d4201b0292207f2e
MD5 9848b3f927eed969e382a163fe2ec550
SHA1 320210269ebdc675aa6ba51b80442a05da7781a0
SHA512 7cc689e75508b0f846b055ce3f5783d2d5df57a299b6f14a01d8ac56bad2a17b17198354c8e41a76c4b99e59cd9cd0e307aaa6cd4120b832c4077ad05aa52dba
SSDEEP 768:arv+4UNbdG34C9DTd+ZL7beX6+qTko0u229a4vsTRUeVH1Sdh:absbU36L7KvVTVKa4vEH1a
TLSH
T18B03BF32E8698D3389E6D689B157768B2F792173CAC40F54D8DDAF0D054B19C270F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 320f33dcc35fe165e3ba6f729723afaa9308351056d7c1d48a1f3c605efb794f
MD5 877762356173e6c87d4e7ff31d8903a1
SHA1 16637d9462d77973edd36ea7c5a7ad1de1921e27
SHA512 11158579a17af3bfa54e83ed3d29f2005652e9b9372d97610e5822bc43eb6095898728124ea01fb0353fb3997d343075f063e98367ad9b6071a1a528abe5d662
SSDEEP 768:YA3ivnDTd+ZL7BeX6+qTko0u229a4vsTRU0uTHqbBu4:YA3jL7QvVTVKa4v0cHsBp
TLSH
T1F3F2B071FC21CC7388ABE289765B368B5EB46173C6D85E44C9EDAB0D014766C270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e7639823dc638ea3857378ba80c8c70b35b509451776a1b490aec174661912dc
MD5 c68d884cf1350114cc678855ab51b1c2
SHA1 03d6b625c111e52816ebc87f91966df3eee6efda
SHA512 800fea7c492a63d733dcb30031bf8a0fe6a478eb35da8fe3c7efe9f054a12c2288b51a10b2529bf3c3ae5d1ca9e7742f345986c49ddea8c6a1a927e801694a9b
SSDEEP 768:Yr3ibtDTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:Yr3vL7JvVTVKa4v0cHsBp
TLSH
T1EBF2C071FC118C73C8ABE289765B368B6EB46173C6D85E44C9EDAB1D014766C270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 56dc8118637d569f1069d085ac50a7a7ff1e55aa157e63708a85170e5deba987
MD5 8c72e96d5ef067cb2f0662eba263ea06
SHA1 f06aad7fe5d0b7f96cf3dd81970de45690655ebd
SHA512 cede03c813b9e098859d3907a2ed584459f403fea1e12206d839542914df62b0f4fdd2a85395495dcd1c68d7238392f90345a1497126e7a5332dea251395b67a
SSDEEP 768:YR3iVPDTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:YR3/L7JvVTVKa4v0cHsBp
TLSH
T169F2B071FC218C73C8ABE2897657368B5EB46173C6D85E44C9EDAB1D014766C270B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7026e8c19acb450b6ac09327d9627fffa6471d3dbdde20b6c5d811f395f29bee
MD5 58381eaf83852c81f48c34c61ce62098
SHA1 1794808057d22c3b60e3a0a8ba84601eafa4e544
SHA512 d53357f0259118f15d0585e38275575644e55fc6623f91b3ba2318c776fe459e8ff6b8ddf11c0546348d1153ef8ec49a088c227a4975b12d161cf7933ed27474
SSDEEP 768:Yc3i87DTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:Yc38L7JvVTVKa4v0cHsBp
TLSH
T1E8F2C071FC218C73C8ABE2897657368B5EB56173C6D85E44C9EDAB0D014766C270B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 477d9a8fd5d30963ecc09cfd082d34720885181a5309eb57226db6dcd64ae45c
MD5 dfeb1f6404f2bb8977954c8e271a2df9
SHA1 d4ccde91c7c72682f9f51b89d3a48ee295ad9847
SHA512 1be2ad5824f2d3469b8787d76c05937880a7d83a3ab9be37ebd7bc9e494862569f9eff07ab52a9524fa896d4d96a0956816f12943d3c65cdc1acbad8f614c47b
SSDEEP 768:Yr3iXRDTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:Yr3jL7JvVTVKa4v0cHsBp
TLSH
T116F2B071FC218C73C8ABE2897657368B6EB46173C6D85E44C9EDAB1D014766C270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 aa047354fbea40d2b194adc1e791a921b07ce7d43d21a92e51f7f04638aa70dc
MD5 0cc2741dee04f8a0b4b8a98df52afc20
SHA1 4646336b1d441aba57b93e05eecf7b12242b753e
SHA512 4c1263a3e0f216421fbe53a2aa322dc4f49c8cc7fce324d0c1e7baffe4aa87606fd84e628277823e3b4b82656d35acf2221675944336b9f098922ba7938f30c7
SSDEEP 768:9F3nI+5DTd+ZL7qeX6+qTko0u229a4vsTRU0uTHqbBu4:9F34L7JvVTVKa4v0cHsBp
TLSH
T1B6F2B071FC218C73C8ABE289765B368B6EB46173C6D85E44C9EDAB1D014766C270B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8d2430359bef30b617695a751f7e76436d8233cf4ea8a6179cbec4c1e8f015f7
MD5 f6e3a34a9b7b203d4308f785ac96ae9b
SHA1 e59c493fa61806ff520c384e4e8f7a0b30d41faa
SHA512 65963ef5560e4a2dfb862cc6abfde19ad56118fd7e3d825ac11ae1d2de9176bdb34d902ad99e66e0a7b804a66956e8897fd0bf392663b2ccf23b166639192b94
SSDEEP 768:wrv+4UNbdi3Ob1DTd+ZL7peX6+qTko0u229a4vsTRUf:wbsbg3NL7ovVTVKa4vf
TLSH
T10B03BE32F8659D338CF7D288B15B36873F782163CAC80A54D9ED6A4C054B5AD270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7562f7695a76cb2fe056ecc8637440eca2265af698005d9556d22bfd8ff49184
MD5 6fcabdf9cf3b3458b101163160319c1a
SHA1 0ed7180011e3f38235e70c375272cb8cd280be0b
SHA512 534d8d633c0131f3280db9572854f6dfee583bb23a2c1daa3dbc748821bbba317a4146c4db6b291ffc4457315b812b106a7d228c3bc0be95cbd84b571a083b34
SSDEEP 768:8rv+4UNbdf3iMPDTd+ZL7+eX6+qTko0u229a4vsTRUK:8bsbV3QL79vVTVKa4vK
TLSH
T16303BF32F8659D338CF7D289B15B36873F7821A3CAC40E54D9EDAA4C054B5AD270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23055acd-d74e-4718-b345-9f9fd9347595.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23055acd-d74e-4718-b345-9f9fd9347595.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\base_library.zip
Size 711KB
SHA256 8e66a86c43e02deb3749cbec38a33d6e1f7fb786843b5982bcb29a5db5646a67
MD5 0bddcd2c1954ed9cf95b39f66ee9c30f
SHA1 4b09fa31a8a6e42f5bcf2b820029d868f0dce8de
SHA512 c543553d81bea63bbbb140204814fffea61ef227a49f6e673b1decb971ed5244c1fc1717cdfa887d6c4f31178bda9c9b86441b7f53f5df66c59115e1319d6f6c
SSDEEP 12288:mbJV0cSO2osQNRs54PK4I1g2jfyE9dHoQDSHk10ax4h00:0V0cSO2osQNRs54PK4I1tjfyE9dHoQDo
TLSH
T16AF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI58802\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkt5i7wx.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tc6tpl1q\gkt5i7wx.exe
Size 5.4MB
SHA256 bd6002bc871a93472cedc4d5711a7042ac245ba8aea5a7d149555c0bf94ec468
MD5 94ff2a21bf5afc4e12005f107ef96eeb
SHA1 d72aef180fd50765716ee78bac5d87cb40760f99
SHA512 28ed0e4f4b15cce7bbe23ca3a3726495258a6e1acbaa2a52008e9334a3bacc831eeaecb6a707c795fe990074b1600d0c135e3562ae11dd2f2af1e70055ae5f3f
SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6to6:GiiICteErownP0oTcMsABqlAuctl
TLSH
T16B463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3188-646-0x000001E27E000000-0x000001E27E241000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads