d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958

Analysis

max time kernel
3s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
Size 5.4MB
Sample260818-ebzzjsvhlc
SHA256 d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958
MD5 38ec0dc709cc646296e57cdfeddb1d65
SHA1 964b352dbd7783b0057411e706b9f474a8864821
SHA512 1f63bd890448be47011dc185494e1d9dcad5345ca419d067acad74d5f596a216640c147eb33a787f0c9a384066e0059b664727ce7b80da41a4ffb52f5fb2d944
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNm:GHICteErownP0oTcMsABql4UtE
TLSH
T1AE463348B3E809E1F9B3E03D81565221D972B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rv4852.exe	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rv4852.exe	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe

Loads dropped DLL 11 IoCs

pid	Process
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\aawnidei\\y7iy1ceg.exe"	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
235	ifconfig.me
461	ifconfig.me
946	ifconfig.me
2079	ifconfig.me
587	ifconfig.me
1396	ifconfig.me
2036	ifconfig.me
2390	ifconfig.me
2914	ifconfig.me
617	ifconfig.me
2785	ifconfig.me
201	ifconfig.me
916	ifconfig.me
1258	ifconfig.me
2955	ifconfig.me
313	ifconfig.me
324	ifconfig.me
736	ifconfig.me
2784	ifconfig.me
427	ifconfig.me
1609	ifconfig.me
2219	ifconfig.me
2867	ifconfig.me
34	ifconfig.me
2070	ifconfig.me
2376	ifconfig.me
2633	ifconfig.me
3041	ifconfig.me
98	ifconfig.me
388	ifconfig.me
1648	ifconfig.me
2075	ifconfig.me
2630	ifconfig.me
200	ifconfig.me
269	ifconfig.me
364	ifconfig.me
1682	ifconfig.me
273	ifconfig.me
410	ifconfig.me
473	ifconfig.me
2065	ifconfig.me
2824	ifconfig.me
2546	ifconfig.me
76	ifconfig.me
118	ifconfig.me
497	ifconfig.me
558	ifconfig.me
2060	ifconfig.me
2160	ifconfig.me
99	ifconfig.me
390	ifconfig.me
530	ifconfig.me
763	ifconfig.me
1051	ifconfig.me
1829	ifconfig.me
1925	ifconfig.me
578	ifconfig.me
1445	ifconfig.me
1726	ifconfig.me
2840	ifconfig.me
241	ifconfig.me
1613	ifconfig.me
1942	ifconfig.me
2571	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7100	cmd.exe
8148	cmd.exe
5088	cmd.exe
7812	cmd.exe
9004	cmd.exe
3124	cmd.exe
4896	cmd.exe
4332	cmd.exe
8304	cmd.exe
900	cmd.exe
6084	cmd.exe
6848	cmd.exe
7396	cmd.exe
8092	cmd.exe
8156	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1316	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4752	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4060	5048	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	89
PID 4060 wrote to memory of 3124	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	90
PID 3124 wrote to memory of 3036	3124	cmd.exe	92
PID 4060 wrote to memory of 4752	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	93
PID 4752 wrote to memory of 4124	4752	msedge.exe	94
PID 4060 wrote to memory of 3384	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	95
PID 4060 wrote to memory of 2136	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	96
PID 4060 wrote to memory of 1872	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	97
PID 4752 wrote to memory of 1316	4752	msedge.exe	100
PID 4752 wrote to memory of 5588	4752	msedge.exe	101
PID 4752 wrote to memory of 5588	4752	msedge.exe	101
PID 4752 wrote to memory of 5588	4752	msedge.exe	101
PID 4060 wrote to memory of 1584	4060	d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe	99
PID 4752 wrote to memory of 5736	4752	msedge.exe	102
PID 4752 wrote to memory of 5736	4752	msedge.exe	102
PID 4752 wrote to memory of 5872	4752	msedge.exe	104
PID 4752 wrote to memory of 5872	4752	msedge.exe	104
PID 4752 wrote to memory of 5872	4752	msedge.exe	104
PID 4752 wrote to memory of 5840	4752	msedge.exe	105
PID 4752 wrote to memory of 5840	4752	msedge.exe	105
PID 4752 wrote to memory of 5840	4752	msedge.exe	105
PID 4752 wrote to memory of 1016	4752	msedge.exe	106
PID 4752 wrote to memory of 6140	4752	msedge.exe	107
PID 4752 wrote to memory of 5096	4752	msedge.exe	108
PID 4752 wrote to memory of 1016	4752	msedge.exe	106
PID 4752 wrote to memory of 1016	4752	msedge.exe	106
PID 4752 wrote to memory of 6140	4752	msedge.exe	107
PID 4752 wrote to memory of 6140	4752	msedge.exe	107
PID 4752 wrote to memory of 5096	4752	msedge.exe	108
PID 4752 wrote to memory of 5096	4752	msedge.exe	108
PID 4752 wrote to memory of 616	4752	msedge.exe	109
PID 4752 wrote to memory of 616	4752	msedge.exe	109
PID 4752 wrote to memory of 616	4752	msedge.exe	109
PID 4752 wrote to memory of 3584	4752	msedge.exe	110
PID 4752 wrote to memory of 3584	4752	msedge.exe	110
PID 4752 wrote to memory of 3584	4752	msedge.exe	110
PID 4752 wrote to memory of 4104	4752	msedge.exe	111
PID 4752 wrote to memory of 4104	4752	msedge.exe	111
PID 4752 wrote to memory of 4104	4752	msedge.exe	111

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7036	attrib.exe
3036	attrib.exe
5036	attrib.exe
7180	attrib.exe
7484	attrib.exe
2768	attrib.exe
8440	attrib.exe
904	attrib.exe
716	attrib.exe
968	attrib.exe
6948	attrib.exe
5320	attrib.exe
7876	attrib.exe
8164	attrib.exe
7424	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
"C:\Users\Admin\AppData\Local\Temp\d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe
  "C:\Users\Admin\AppData\Local\Temp\d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe"
      4⤵
      Views/modifies file attributes
      PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7fff6100c188,0x7fff6100c194,0x7fff6100c1a0
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,1903212086178683034,1497020585346407719,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
      4⤵
      System Time Discovery
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,6697961005625383940,7508844139916417654,262144 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17385034447583164371,8481611190071825688,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6743968621753672987,2919989351585918362,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,15741205945323305725,7520757323932268797,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4460,i,11633239972619629835,14132372775431087856,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:1016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,854907982582248744,15187373996409092864,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:9
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,14962788816019205633,10894777012820476154,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4840,i,10939760016409386456,11510590305393824451,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5028,i,11617177466420563639,13930819355409913722,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5272,i,7454637322675072611,12243862043375705235,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,247007023469727137,13268959849998121984,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5928,i,10348331067653968957,17848120068876985996,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6288,i,13872350947877194192,16025042112863435175,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,4633334387148399358,12602167483027540194,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,4633334387148399358,12602167483027540194,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,7927599494787769462,17047648200009981995,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6532,i,14319635345253962919,6562144650356769394,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6000,i,7211999658180021136,7834824051904156272,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7260,i,6067278310468335498,13538170065240043434,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7304,i,17116921887801877561,6494372929751196031,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7344,i,6603097124185703290,15013751758218902772,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7428,i,6696339112692575663,13643768311668924199,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,18441628704033561453,1866660666479953063,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6584,i,8068995973909743561,10658331567916447221,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6604,i,2940045341581365532,11480127866997772851,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6624,i,2271104896669892796,7863497578096028041,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6708,i,6153798493104628044,5396815641931098218,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6716,i,10227826450351385373,17453231289592582468,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7272,i,11312080050300707106,14425894655189482188,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:1
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7308,i,14612441995137369095,7367729867466504540,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7404,i,17426619078421555705,14602662776323757476,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5836,i,9639525375544357898,7496815767677733666,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3996,i,4046036620107214092,15808184206310052773,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3868,i,1459410500868502133,9454640843957036654,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:1
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8274328537263892222,11360780247186003840,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7520,i,2430844218239556049,14479508858105516103,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7768,i,13955597843862667056,8089105052626689752,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8268 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6064,i,7584884237749048558,1207669844416108169,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6076,i,14636586677710316883,2262061787161127132,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7712,i,2985761024077295660,3358079890528231818,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7852,i,14248822214307823764,2189392452700708304,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:1
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7812,i,13998453086770619840,15908460269518160557,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7860,i,11685876597119685796,9901711452578112474,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7528,i,6459996761431766413,13424277840235652333,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7784,i,10115144396203698620,6788816836786102105,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7836,i,1715991975992222559,3064106666519489329,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8300 /prefetch:1
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7912,i,3607022200895845858,5591765167483391879,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12184,i,13112057091052688318,11998140904862921454,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=12128 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6608,i,18387938108325766185,10356258709136633256,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=12008 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5912,i,12552019713308047617,672409239112422101,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4312,i,11179420534121942472,16612295389807282320,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12468,i,3116580886516818886,7685268971167128562,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
      4⤵
      PID:8336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12484,i,16346277789319354768,6732191124223744342,2097152 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      PID:8368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12524,i,2936698875802939271,7399218717528605509,524288 --field-trial-handle=1884,i,7035157205364239003,14176100309203896313,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:8392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4444

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe
1⤵
PID:3064
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe
  2⤵
  PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe"
      4⤵
      Views/modifies file attributes
      PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3844

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe
1⤵
PID:3380
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9m77zhpq\9em7i8te.exe
  2⤵
  PID:4884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe"
      4⤵
      Views/modifies file attributes
      PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4672

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe
1⤵
PID:2820
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\87hixawt\8yhr505a.exe
  2⤵
  PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4332
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe"
      4⤵
      Views/modifies file attributes
      PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:52

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe
1⤵
PID:5900
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13v0sfep\rulz5n6a.exe
  2⤵
  PID:5256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:900
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe"
      4⤵
      Views/modifies file attributes
      PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6036

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe
1⤵
PID:5192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dn1s57tb\e2h8zs0n.exe
  2⤵
  PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6084
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe"
      4⤵
      Views/modifies file attributes
      PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7148

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe
1⤵
PID:6804
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2dipn5xy\8sq6ea97.exe
  2⤵
  PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6848
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe"
      4⤵
      Views/modifies file attributes
      PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7112

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe
1⤵
PID:6872
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\noorb2bw\pk777xlu.exe
  2⤵
  PID:6676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7100
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe"
      4⤵
      Views/modifies file attributes
      PID:7180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7452

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe
1⤵
PID:7676
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\30ug07n5\2jquhbq6.exe
  2⤵
  PID:7748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7812
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe"
      4⤵
      Views/modifies file attributes
      PID:7876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8160

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe
1⤵
PID:7240
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f1dsu0iz\ggv3j8o9.exe
  2⤵
  PID:7304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7396
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe"
      4⤵
      Views/modifies file attributes
      PID:7484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7816

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe
1⤵
PID:8016
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v4mwfvzq\557n36qv.exe
  2⤵
  PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8148
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe"
      4⤵
      Views/modifies file attributes
      PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7416

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe
1⤵
PID:7828
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zj0b2258\w00bv854.exe
  2⤵
  PID:7820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe"
      4⤵
      Views/modifies file attributes
      PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7604

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe
1⤵
PID:7892
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnuf7ei8\9vtyaq7v.exe
  2⤵
  PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe"
      4⤵
      Views/modifies file attributes
      PID:7424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7700

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe
1⤵
PID:7392
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6757hgc4\ifwexacj.exe
  2⤵
  PID:7896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8304
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe"
      4⤵
      Views/modifies file attributes
      PID:8440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9140

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe
1⤵
PID:8924
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jhjv0e4k\xn5jimgi.exe
  2⤵
  PID:9044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvv547op\wjcuoi91.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9004
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvv547op\wjcuoi91.exe"
      4⤵
      Views/modifies file attributes
      PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 280KB
SHA256 c795e86e2182ca03afca58492c60a52b8b6ae812b95f2d477d9c9469747be3a0
MD5 1ed8514100eb8b5c63cdeb7cda1331f8
SHA1 5be771ba173951086ffc9aa3cda212b54cf9a299
SHA512 17e90877d943b3fa20c0da4d7ed1d7daeec4ad0f2e093448dc7c281f739a84adfdf880b384e7f8e6a3c21509f6f0bff95e473a06ed7d1ced52d02191b45b8bd6
SSDEEP 6144:5jlaR+FeUbuFjgHBWQkmJOKWrSIp1g9LTMD4Inf3W7:b+EbusBzk4OnSIpy9fIVf3o
TLSH
T18C54227DFADE93A079A147861ADFCE81D0BEFCC2956EF84BA6184539171F9C0CC69810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 75KB
SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
MD5 51057372ceadf31ae00dea7bb0dfdc63
SHA1 52d48aced7d33d38ac493c1a686f77a7e55cc45f
SHA512 28e3f0939fd7905fc3ef67a2f7e3267c46da3c9c9bdad6a8d600b6151e03f476481c7a08f3b9689e6468be0c5c371951ec9abc8e7045ee1509de620bea4514e9
SSDEEP 1536:vgrl/ZcRVJMgEM9KwQ2cMIsUlcuWM7Uldr1RgxoeoXUUsN:YLyOgK2POZoldZRgxNoY
TLSH
T1D0731288EFE7CE1D114A1A6412C79C1348E8654BC059926778F08DEFDC98F86E6B9D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 205KB
SHA256 e74a551475ca3c977a6a9c6c3adf6c9a0835fb0649ab70facf1c84796a04ec64
MD5 400a127552ccd757a7d1b122b1433497
SHA1 11211398d64a6b65af38575e045663c8e1b995ce
SHA512 d9ce468822d0d0f02a1fd50cccc0badbb8d490929ed5662e9e9cf1e7015aa9c7f2cf1652d9a5608aa817b5d77f8076a3a4ece83c2f43b35d85997dbd7b87c2fc
SSDEEP 6144:bj8NBNT44hUIswJ7VVG4ZXXePeq+DQLLX9CJITmTENK/VrgzxLh:bANB544byonZ9DQLX9bTm+6g/
TLSH
T16724121588210F27A1FE2A9C51AA7DFCD395483C3C0AC5D0A2EF5487100FF5C9ADBE59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 219KB
SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
MD5 b6c25f8ccbe00d0eaf13ff1a6533a0cf
SHA1 d733ffc69373c48426c8d5cfe362b67656292b55
SHA512 62f9d6a232f111fdd348aafac771fe4bbd81ec21e404b067b78762433f52ae2b556d500fe0f339fa972f57a1c3d4e9cc93db3f5db2333a3734f725cae650a613
SSDEEP 6144:6zsBIS3R1PzeGe3MZNsydCGTRfyRrvnKkAcU1z:6gOGzzeJ3MvsFqRfyFvd8
TLSH
T1F62423E086B35DB157369BBCDB23FC05732731B11A6E794AB7C74A47A11C42874EAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0a19061feb68463_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f0a19061feb68463_0
Size 562B
SHA256 9ae8ac0383365f859ff90c5d5cce4c9a1532ca50dd0192c7c53445653cd00d5e
MD5 77cf4a5c1229849f0f6dc70b25a6d8f5
SHA1 a4716dfa12e31f9330edd1947411a103902e150f
SHA512 705bf9b094974c6ced9b5c78516f359d366d432eee0a89fd041a64168eec3f2c5340055d309fd442028ede5c6b70ad6e3ef962ebc2869c4d14692d43e62d95bc
TLSH
T15AF026D3610CE805E22E0BF5CADE93398301E1758F5C47A5D04420E333038347708094
MD5 SHA1 SHA512 TLSH

Submit Download

fc59af036509d30c_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc59af036509d30c_0
Size 230B
SHA256 f5e02b462e16c6c0be73a72c3b74c02a59717f510ef63b9d436f7c03cff933b7
MD5 70867308eec9896d6a7477a8bf5d6d56
SHA1 c784e8c150a8ef8c9e56a96aa1f4b988360edfd1
SHA512 e43a4418240edce5305b891b8d96b71fe7153e23694b8c6e4cbc1038df571bbfcfb73878a2e1af9371a18f9b78e20867e86e326afd39a0fcc56dd1b707030a08
TLSH
T106D023DF961D5822DD7C4DF4C9DF1141C3138414442C92D1914250F371154F1E348721
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4b9a69ee84c43c836ae00ad1448ecd736290553a3afa247b084c54ae54238a5
MD5 72471c0b0022dc3bde4649325f35b251
SHA1 0868daa84b5d8758b681b09dbb4a8d3d89fa157b
SHA512 02b92c893be96d2ddf21fe350265cca3ab698c4279864d247cb68d8e5d7403a9f5936d2bb243e7fc94eb1c50d7def098bf223f1a86ce81d9eba54e9e36235c98
TLSH
T19F61D7A1436749D1EB347776A0E05B5B3BF49875CD17EEC62B436EB06806F1232D0427
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ac0adb3a69ecd71349b2a1cd576a0c10d4f12e8df7ffb1daade27204dc374be7
MD5 58cbfc4cd72cbe7ff463c7730dd5a7d0
SHA1 96dc61f9b88facabded1fc4e02aed5b34d0dc44b
SHA512 a1c01d8aadaafe70617364b158c3fec0958236035ce84100b6076f38eac88af23fa37c7a7869a6cb7789d50ad5ab4bb01675d12c570227ae0db903e7f7c448d9
TLSH
T1D261F891436749C1E7347776A0E05B5B3BF49875CD17EEC62B436EB0280AF0232D0427
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 09f0bf5510e2d218d2eaf9c826004c51152e1b5cde8a02f03956fa96eebf1e7f
MD5 9107df4e62afe0ad07aa161db5d7f1e3
SHA1 c2e32aaac9bc608394d282e34c349bca3cbf98ed
SHA512 4654a8c9f45c0603f220d67aafc02bd93c442fc5ef8482f9cf182b0029bb054357724fbb0afe0c669a3943b1f624353d7eaa7adcdb18c6246103355eef9851b5
SSDEEP 192:sxRwReCB/fdsMtHm2Sm7al7zoD8pMCyFSHg6+WN28afYBzL27SGvIgVZJ:sxRwzB/fdsMt27I858fKAZ
TLSH
T1D442C9166928BD3B4CD7E21DFA25BF13D6F9513261D11E45EBFC8A1C04E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39daf6821de4dd163d86b8845baa8935b5c36d2b9b80ae1c457018de1e16b042
MD5 27109868e55fd21f4cce0d37665bdceb
SHA1 9c799e53cdbda634cbca4008ba1d3c1dc93c8507
SHA512 ccc20b048ae41b125e2b75c77848886c0093acc1adcf107ea9dc83ab8b3273c72c9c61cce97273a75d05f9dfd2dda6ef7f35d32c7b298277c7617fde5099fd8e
SSDEEP 192:sxRHReCB/fdsdYHm2Sm7aY7zoD8pMjrmzRFSHg6+WNsQZl179K3Ju9/YBzRLSGv7:sxRHzB/fdsdY2s6m85tXqO/27
TLSH
T11252E916A924AE374CDBE21DFA15BB13E7F9513295D01E45EBFC8A1C00F66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 807b0265a31c2f69524d9e69ba26073ce89c8e6ed2ea4f526aae15c9f4f46ceb
MD5 3094ed3bd5e43905cb5b1e19a33363c5
SHA1 9f483f8d258d638d07daf6b5456541ee9acfea35
SHA512 b97b90e45d1ae7604c7538c8121c459cedd26d4f7d65247e83dc9c7aad050bde3acc8dc9f8103810ba13cc8234bf035ee604b24fedc98e3667e875465f519901
SSDEEP 192:sxRHReCB/fdsdtHm2Sm7aT7zoD8pMamzRFSHg6+WNsQZl179K3Ju9/YBz527SGvp:sxRHzB/fdsdt2t485tXqO/UAp
TLSH
T1A052E916A924AE3B4CDAE21DFA15BB13D7F95132A5D01E45EBFC8A1C00F66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 87e0e984880ee1d6f8be23497a5f6c8f2e1a3264cf25e69d3546048c328daa23
MD5 fbcd6223fc83427eb975fb1535ecd021
SHA1 483b0643179f99bfdec0325384b00bb9526a453e
SHA512 e7a5f6dd50493962c3bb9540fc7db7bef1f9b5e877a886aa5692c23bc2ed2c50876af4c8a425b7a8985a0b690ff63381ea0c2953fb5ec5f564c3e889082c95d2
SSDEEP 192:sxRHReCB/fdsdYHm2Sm7aR7zoD8pMRmzRFSHg6+WNsQZl179K3Ju9/YBzRLSGvIQ:sxRHzB/fdsdY2nR85tXqO/2p
TLSH
T12652E916A928AE374CDBE21DFA15BB13E7F9513295D01E45EBFC8A1C00F66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c96c5675fe2813608601e6488f66f07ff539a8972107c86405240e97df807d88
MD5 6f5bb9dd4adcf91832791d130fa9d497
SHA1 a34ad35ce4c05a0726e102d97caadbb4cb31d7df
SHA512 71908b3f5bbf4946fc5b088e1f649013ac115fe2763ca40d892647e000f47c3f1a1d87b841a7b685776eacd43cd08f044062b951b9f905aa9b14418f51fca0b3
SSDEEP 768:GTEbXo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJMWcDroRFLUir4:GTEbXUE7lkWg0CfKsu1jaiFcwn/r4
TLSH
T1A0C2EA7B740DCB7E4F804ADDA819BF9B6D6802CB5A98CD8047FE851C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 297f79f9861254ab6264a7e1038807c2b068e33e47d11ed037fab85431970c6b
MD5 a201b34f92258909617c9a6e90b2560d
SHA1 a26986ac61ccb8e6df1676f9660b2fb31e2d53e6
SHA512 513f84d52bfdaa4eda9d2b451c0f23d9c6f5d0f4cd2d2abda6b72e5d5f6475e70cb1d1982a52484eed27ef33badf56ce2106147f41e51273d02976606f9dbc29
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHI5MYKWaAW+jTgAAK4VgiAzlyKuQyGJ0:C1i7PF/DWrwfX9mgpct1o7zsHI5MYKWC
TLSH
T15A911056357A12403C3EAE0CC1A9996AA6C270A3301CB52B7BF955E51F6BE034CFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb0bf7073665ee7fd099a5e372081e0c8b091e318549909f4c3cd46ff18d931f
MD5 455b7d3f4ff501ee9a2798f386b283f2
SHA1 f0e00b2ed64ee1869e22247e82a98a82f86addca
SHA512 2d8ff7bc3a3e218a8a4edaeedfc4cdf3c46a9e33ba73bef1eadd18f62d9c75717d352ae37591b4e4c71fb59a61630420ce62f175a85e7a33d1b20a3a9d197040
SSDEEP 768:Rrv+4UNbd43h3kc+wfZOpfo66+QFvShCQtJ2bwWV:RbsbO3huwfqf765FvSt0wO
TLSH
T13503D072E86859339DE782487646BB63BEB96273C8C54784D6CD0B0D018369F370FC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 99d81d58f1cb73f02d8392b35e9cfd205635736c34cd38bab5d51d598271a176
MD5 073ac8c4f516bf2bab5f95d41d7cb2c9
SHA1 982c49d1021a477ab20e1879c50ee26f06037263
SHA512 44bdcf4c60d3df58891b21bcd53d5145ef570e0c60c4130b6b51ef17fc7488f81abb0025fc96ba6c6b2fde11f284758eacaa6b9aabddb71d51da0063b6dfc136
SSDEEP 768:yrv+4UNbd43eSc+wfZOpfo66+RfNBvShCQR/2bwW2:ybsbO3hwfqf764f7vSb0w5
TLSH
T10003CF72E9786A739EE786487606BF13BFB99263C4C54644DACD0B0D018369E331BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb72e11e707797e959d3fb3d69871bad5d932ded17cd002f4150b72f38f3053a
MD5 f120ed39a20a866e611102af0e8f0a0e
SHA1 a54136905ac2a310c325c685f734221ee5a7a431
SHA512 a0a5796d39b95b7f530a3524462edcbdc362ed31892cca7e5b5e48cc22dde4ff07c55f1d03812c012a640f562f6f72fe32634d4a4793e88fa63de2437fc0767e
SSDEEP 768:493yWc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:493lwfqf764f3vSb0cHJ3B8
TLSH
T13AF2BFB19C602973DDE6E6597A067B07BEE4A233C6CC5644DDDD4B0E01C36AD231B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cdde25929f96e31a6f7b12305d36755aa3c8928431e981919793c5e71d6a5897
MD5 00ea5e9cf2d4d0732525e096de6c6ac9
SHA1 1f2d6d000336babf98c59b9fcc2810667425054e
SHA512 40d509ddabac5ea2ce74be3740c46b86fcc1b683c8f093345714dc2e46b7ab2f384618b06c7a19192f3296e9751cab84c6e74e7bf65786f90e8281833dff9599
SSDEEP 768:4s3YCc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:4s3Lwfqf764f3vSb0cHJ3B8
TLSH
T1BDF2BFB19C602973DDE6E6497A067B07BEE4A233C6CC5644DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fec0ea5ca71713f04bdcb6306fe1941e14a1a684fcd5ce6859580714d03ec1ab
MD5 e0aaf606bafbf1d4b8f3101dc1ec0555
SHA1 90bb2bf742f4ade899fcafabfc1c10303323ac0e
SHA512 f5426657ab4f541512b6df0c37d90640f4dc0422945af61907d9d754e73f7ecd8f1277429bd4338729e86b3984aa3557967888e63ca6909a82adf1899ff1d668
SSDEEP 768:krv+4UNbdz3kWc+wfZOpfo66+RfNsvShCQR/g:kbsbV3Xwfqf764favSbg
TLSH
T13103CF71E8786A73DEF29648B607BB03BFA45223C4C54644EEDC5A0D41C76EE231B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7202e76f0a05a3b47fce182b53365af175486fddc999d73fee9648522fa36264
MD5 859834332008b7e91c0f660c29e48002
SHA1 f44daeea183d84a506fd64d7caae3ebcaf4f4b33
SHA512 c971d380f6c87efb3e8d14937c2fca7fe2685b5d5eee2a0dccb0957c29035b4dd79e0d110ae8e24ef3c522032bc8205da3930b5d9b5396e1a3655bb78f9931b9
SSDEEP 768:Ag34Ic+wfZOpfo66+RfNYvShCQR/0uTHJ3Bul:Ag3Jwfqf764fCvSb0cHJ3B8
TLSH
T1D2F2BFB19C702973DDE6E6497A067B07BEE49233C6C89684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c55d0391b6e5a9e452001807e656961b3d86ed6e1e3bc96ef5ceaf77fe1d219d
MD5 ff707267e9cb63fc3e6c7faf008d0492
SHA1 672433ea000991d3328bc95aa703e32ba3ec7054
SHA512 fcd181b186df1b69fc9d70e2177a13439a87288c7910329b2a90997c3ea53825e51bb5fc04322ef2005342c7387a00ac99d92c694c95422a1250103ffa994771
SSDEEP 768:AJvs36+c+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:AJvs31wfqf764f3vSb0cHJ3B8
TLSH
T1B2F2BFB19C602973DDE6E6497A067B07BEE49233C2C85684DDDD4B0E01C36AD231B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 952840a2f80896d59cee4d4f5855ba4507c5144db698c6fdcf2df1ba2360fda3
MD5 05c6de5823648236836b0c148c08bdcb
SHA1 6eac7c240b181613c0dfdf2c206d789bb893dc44
SHA512 7d23991d6b6e5567314e436e1d05cd0882aeccb131ae2a22dd44782dcb98867ec5312c8f3247ee07f3864b3752696ecf4d6e98a0a5433c5ba54ee8c2200d358d
SSDEEP 768:AP3GCc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:AP3Fwfqf764f3vSb0cHJ3B8
TLSH
T10FF2BFB1DC602973DDE6D6497A067B07BEE4A233C6C89684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 53d04cf95800c920c76e926f78f2f13a1b2eb3bbeace6610c751a275f394cb3f
MD5 5920f014e1e5b836fa85c64428ba85c2
SHA1 4baee287fc5e7c63c65726c34d1465b4294e1bcf
SHA512 cb8f3f1dc3428d4be091ae93d055845e8c8c048531315585af7495403389e7ed7f06b42e39401725ed53c7a1a150cdd1adb8c59ed67196d05e104bd9054bb013
SSDEEP 768:A63Voc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:A63Uwfqf764f3vSb0cHJ3B8
TLSH
T15BF2BFB19C702973DDE6E6497A067B07BEE49233C6C89684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 532915085c26fbc6b1e35f3eefdf87fca298cd641c9ef16586e7a822ceb01c8c
MD5 d7d34a76a986b2b4ab381b1ae8aa02b2
SHA1 11cd96ad75bcd0ea85261ebe356914e9138950d7
SHA512 51d92d453750a6a2349d5e0380759414b77271d153bad338941287dc5f826e4cadb5bf8944e822b3c7e9548dc13a41e74a121b22f2264f92be39c4e1885d9c59
SSDEEP 768:Ah3uwc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:Ah3Hwfqf764f3vSb0cHJ3B8
TLSH
T1C4F2BFB19C702973DDE6E6497A067B07BEE59233C2C89684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 40eeadf94fb43c1a0a59bb2090a177fc309892b87cd4b45e496b568e2ea9f914
MD5 32220fd4200e08eceb5e8f2fbb309962
SHA1 1d6c2087d41a3566a4daf64df9f24b2b02b1b675
SHA512 357568d74eaaeb808b4c8fd02f95ad2168030b1839a6e8f98aa15bb2bfe9eaa009b479548d11ca1335c2d4c15bdcbcdae05a18f47d4c83a0625c69624be80ac2
SSDEEP 768:Ak3kWc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:Ak3/wfqf764f3vSb0cHJ3B8
TLSH
T1D6F2BFB19C702973DDE6E6497A067B07BEE49233C6C85684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eca017db837a9c2ccee1dcf6665c8ff3903669200f000855559e10479d60a2a4
MD5 81f1419402c0b2ebaa3aa70d499cab08
SHA1 7c25fa0b107f28786db9438259fcf52d8315cd8d
SHA512 5c1cb2b9316c1c27c98478d3ebdcf69e39f431de82f55358aa375961002d6415b5deae248bea7169c2f4adc7a844e248f26e0cf16f192b7e75c33669c47c0409
SSDEEP 768:Ay3JOc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:Ay3Swfqf764f3vSb0cHJ3B8
TLSH
T1C4F2BFB1DC602973DDE6E6497A067B07BEE49233C6C89684DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b350c04e4728e2d55bfe671bc0cad9c98b3abdc0e3c46fe7aecb56a951e7c00f
MD5 5697a9a78b2c05a0894823cc551b5ea4
SHA1 f8854833c52ab9fd3d3e5a1bf156e9ea06935a77
SHA512 9d18a7ad1b20be295afcdabe1df9d82015c27df2c516084488da8a16b93c377ffa2fa915220646211b8eb03d2a5cc4187cbdefb0b0780a37dc2853f846c234fd
SSDEEP 768:Ao3BEc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:Ao3Uwfqf764f3vSb0cHJ3B8
TLSH
T1E9F2BFB1DC602973DDE6E6497A067B07BEE49233C6C85644DDDD4B0E01C36AD231B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bdc76f254f8a357153ca1bd8a8604100f811b1268bf1c8e1de18262b53cb6ad6
MD5 3067e6e654ae64baf36cfb578c7118f7
SHA1 3c8ca9b13b0c23c91beecde7ef855a26db086812
SHA512 b556ee5c8302b8973473b588d9e6fae43b31866ca068b4bdb1b6759af4cfee12cd6769a681d65c21b7965eed2de30c794158dcc3bf8d361f95621226026694c0
SSDEEP 768:AK3L4c+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:AK3uwfqf764f3vSb0cHJ3B8
TLSH
T1A9F2BFB19C602973DDE6E6597A067B07BEE49233C2CC9644DDDD4B0E01C36AD271B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cf2e46e04e4ab3e4f2cdbaaef54b240c75e484a7180def54a5236e29486496f0
MD5 658b4d85006c84074dbd0de0c47b5d79
SHA1 6497341595ecc001c76f78ffa0d54a1abbf5f497
SHA512 b9148324f9cd6cea45c72c9ec6cac71f36141b56dbe9e0181b56e55891a79638e253936b35c14b33d66ca46852ba1b54e4f4f6a9ddda6a42b6fd6241cf3f52e3
SSDEEP 768:Prv+4UNbd43pkc+wfZOpfo66+RfNBvShCQs/2bwWV:PbsbO38wfqf764f7vSw0wO
TLSH
T14503CF72E87866739EE386487606BF13BFB99263C4C54684DACD0B0D418769E331BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d43249ee-5e98-44ba-81d0-d427e728ab62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d43249ee-5e98-44ba-81d0-d427e728ab62.tmp
Size 35KB
SHA256 22e7ad4aaf48c039d6496cf9fca139b20c144bfc79f3ebb393542857f60cb796
MD5 c1b553478856a0fa0d6f8a03d40b10ad
SHA1 26960f340661eab3703de8fad5d859f5297b8684
SHA512 04026ef0ccb08a6cf222e9300af305d8f82a01cd1a344b94ca0034a9da1d3ac813ee1c66bd02498988fe8f45b1b3e5705c851f19c35d5c3fa06085a6a142dc0e
SSDEEP 768:4K31cc+wfZOpfo66+RfN1vShCQR/0uTHJ3Bul:4K3Iwfqf764f3vSb0cHJ3B8
TLSH
T1C1F2BFB19C602973DDE6E6597A067B07BEE4A233C2CC5644DDDD4B0E01C36AD231B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0eb1360-4f52-4452-b462-3052a41f29f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e0eb1360-4f52-4452-b462-3052a41f29f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\base_library.zip
Size 711KB
SHA256 798c3605fe24d94228acd75622d03e23f022b3b918e266be852c20fa27bba0a6
MD5 05d0908ee6fa68c754467fd809f1d9c7
SHA1 cd98cf488daa557e2209fdeb9854567cc0caf784
SHA512 898481b2da12d3394b716f2bdafe025ca8c5a6c8ed2b0e5059dbc32518867c34264a8b53be1f46fd62bcc29e57348169d61a06b7dadd8bd0784ba661a1614d98
SSDEEP 12288:M82osQNRs54PK4I1/k11Eddc4axDfyEDV0cJaoQDSQhmu:D2osQNRs54PK4I1/7dC4sDfyEDV0cJaj
TLSH
T171F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI50482\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y7iy1ceg.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aawnidei\y7iy1ceg.exe
Size 5.4MB
SHA256 d1f219a5f6af63e92b30cdc9e84078c9a5a5dfb10320664d92351b03f2d84958
MD5 38ec0dc709cc646296e57cdfeddb1d65
SHA1 964b352dbd7783b0057411e706b9f474a8864821
SHA512 1f63bd890448be47011dc185494e1d9dcad5345ca419d067acad74d5f596a216640c147eb33a787f0c9a384066e0059b664727ce7b80da41a4ffb52f5fb2d944
SSDEEP 98304:jHgtHICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllSHmMOQ6tNm:GHICteErownP0oTcMsABql4UtE
TLSH
T1AE463348B3E809E1F9B3E03D81565221D972B4264BB0D2CB436C9B662F677D0BF3A754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads