Overview

overview

10

Static

static

3

02fcb40dab...6b.exe

windows10-2004-x64

10

02fcb40dab...6b.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    57s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/08/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b.exe
  • Size 5.4MB
  • Sample260818-ppwjdssdld
  • SHA256 02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9806
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3618
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4546
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5106
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6401
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2507
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1606
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4189
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2134
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1139
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8909
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4142
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9505
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6264
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6839
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9862
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4431
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5386
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8863
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3754
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5842
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user7082
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6113
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3826
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4127
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9411
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3049
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4086
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4240
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1473
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2647
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9251
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6771
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5649
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5187
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1235
  • Password

    password123

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 13 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 11 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b.exe
    "C:\Users\Admin\AppData\Local\Temp\02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b.exe
      "C:\Users\Admin\AppData\Local\Temp\02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe"
          4⤵
          • Views/modifies file attributes
          PID:4492
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:3700
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffc4b4cc188,0x7ffc4b4cc194,0x7ffc4b4cc1a0
          4⤵
            PID:1592
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,4549001690806375499,6271204469559060052,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
            4⤵
            • System Time Discovery
            PID:2952
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2111608311734958754,6986814552430030963,262144 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
            4⤵
              PID:5072
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,11207856060734564170,4176029226722769005,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
              4⤵
                PID:4148
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,16500628705257065530,8181442376716636851,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                4⤵
                  PID:2604
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,10749698585983802975,3862441918341543922,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
                  4⤵
                    PID:4288
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,580269478576238979,13070572620625336462,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
                    4⤵
                      PID:1164
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,17756395316291411149,1504435853420101680,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
                      4⤵
                        PID:3592
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4704,i,4709925545653762463,11644282797069767880,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                        4⤵
                          PID:5084
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5204,i,17299513766181604244,1272952848387900380,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
                          4⤵
                            PID:1144
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8339957409356895855,2483334358282949454,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
                            4⤵
                              PID:4264
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5696,i,10810507485871745325,1504759465567524843,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
                              4⤵
                                PID:3744
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5848,i,3363157692530434174,17148461309120401138,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
                                4⤵
                                  PID:4704
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,9930671181199272152,14734929954027776445,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
                                  4⤵
                                    PID:4900
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,533872985061758915,14574454250654635720,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
                                    4⤵
                                      PID:3284
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6496,i,6067719094846062919,15640728927202405907,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
                                      4⤵
                                        PID:456
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6516,i,13281616801747830374,1909929324894722411,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
                                        4⤵
                                          PID:5016
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6852,i,2931471599398620509,11389205746334101680,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
                                          4⤵
                                            PID:2804
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6996,i,13432979190467279861,6377967072437505171,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
                                            4⤵
                                              PID:5240
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7108,i,6167845249123394710,7669467922001482533,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:1
                                              4⤵
                                                PID:5500
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7320,i,3778070428376923793,13579455024357037783,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
                                                4⤵
                                                  PID:5636
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7484,i,6895838034305152607,9495334529882494315,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
                                                  4⤵
                                                    PID:5736
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7672,i,3988309302593971951,12824136392472264428,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:1
                                                    4⤵
                                                      PID:5852
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7812,i,6579356175399120400,3437580443944022259,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:1
                                                      4⤵
                                                        PID:5948
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7196,i,4685154117454708543,4786652935644198937,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:1
                                                        4⤵
                                                          PID:5168
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8220,i,8324022863708876830,8061908726995745096,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:1
                                                          4⤵
                                                            PID:5656
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8424,i,2157227559925525655,9375867471165138814,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:1
                                                            4⤵
                                                              PID:5424
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8568,i,2362829017460417901,9374858356157296304,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:1
                                                              4⤵
                                                                PID:5180
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8644,i,11626942763355309691,17707021573122161837,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:1
                                                                4⤵
                                                                  PID:5512
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8760,i,2899943301345083750,10005433122729226641,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:1
                                                                  4⤵
                                                                    PID:5652
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9088,i,95150311986419062,10860193143056731201,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9124 /prefetch:1
                                                                    4⤵
                                                                      PID:5144
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8936,i,8985171128156066293,11818102667840515967,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:8
                                                                      4⤵
                                                                        PID:6412
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9720,i,8301927086171556978,8779641440696271064,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
                                                                        4⤵
                                                                          PID:6564
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9916,i,3432192355220520282,9633056968638958270,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9932 /prefetch:1
                                                                          4⤵
                                                                            PID:6760
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5432,i,9173053769401754858,7045280141496944587,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
                                                                            4⤵
                                                                              PID:7000
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10176,i,14939091967696192124,12551386067067041543,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=10164 /prefetch:1
                                                                              4⤵
                                                                                PID:6156
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10276,i,2241873649406603472,2081876495821643246,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=10412 /prefetch:1
                                                                                4⤵
                                                                                  PID:6172
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10624,i,4494100098011877552,13632437126124267662,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:1
                                                                                  4⤵
                                                                                    PID:4264
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5408,i,13930337503660084107,9364003585401550652,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=9916 /prefetch:1
                                                                                    4⤵
                                                                                      PID:6076
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10928,i,9803313698552897517,13122560903958764463,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=10728 /prefetch:1
                                                                                      4⤵
                                                                                        PID:6784
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=11056,i,4047660319602084642,4401385501977226476,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:1
                                                                                        4⤵
                                                                                          PID:7112
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11224,i,10789879707484373864,13155927986601355244,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:1
                                                                                          4⤵
                                                                                            PID:7188
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11380,i,11351463435673375307,4618408346200915214,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=11080 /prefetch:1
                                                                                            4⤵
                                                                                              PID:7296
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11496,i,13608941064180407092,12628213786081574686,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=11540 /prefetch:1
                                                                                              4⤵
                                                                                                PID:7356
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11688,i,8154153216923280552,12700455330381306315,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=11712 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:7424
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11240,i,18108769496001868617,9550682843041380070,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:7632
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12024,i,338566986814663774,11012505622274558902,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12040 /prefetch:8
                                                                                                    4⤵
                                                                                                      PID:6928
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12024,i,338566986814663774,11012505622274558902,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12040 /prefetch:8
                                                                                                      4⤵
                                                                                                        PID:7140
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12220,i,1582266249933482690,13122575476903295543,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12236 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:3548
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12400,i,5302829052282924994,576040795054413647,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12364 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:7840
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12420,i,554887591133604141,799823654355403599,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12580 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:8020
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12772,i,13043713466459493401,3210235080002540167,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12752 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:8180
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5792,i,3193224691661126314,8327978732869105821,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:7368
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12944,i,15287336293792994405,15315753026806684597,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=12956 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:7560
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=13132,i,13179398251257344209,4305707637969707836,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=13128 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:3204
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13412,i,2783276023279185635,14745077689686167573,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=13440 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:8520
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13404,i,8973528064842209223,16262485767012278078,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=13584 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:8552
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13744,i,5655814772934160777,13345519113993267463,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=13724 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:8664
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13928,i,2008348329145352086,14658057258962656123,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=13876 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:8796
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=14048,i,4535753109432231752,3536679625178183136,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=14064 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:8844
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=14800,i,13785863319064538817,17868625651971399640,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=14808 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:9016
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=14420,i,7301646165222242120,9055153457519675464,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=14824 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:9180
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=14104,i,13025307029830058205,10899536191955883966,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=14896 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:8564
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=13636,i,3586316125276527412,7309619006170291843,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15024 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:9264
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15148,i,16460815382312661912,15531725343070605329,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15156 /prefetch:8
                                                                                                                                        4⤵
                                                                                                                                          PID:9344
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=15176,i,16933052113554293905,17409395438259236159,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15220 /prefetch:8
                                                                                                                                          4⤵
                                                                                                                                            PID:9352
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14936,i,1867225121335142900,12004126575165194503,524288 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15264 /prefetch:8
                                                                                                                                            4⤵
                                                                                                                                              PID:9360
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=15408,i,6876048486541777867,8757390227509705412,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15436 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:9696
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=15656,i,5310927112841962340,12380634712244635178,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15696 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:10112
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=15808,i,7984370995309458602,410882686660820474,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15844 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:10140
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15980,i,3022117587335505984,922206396926608860,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=15984 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:10188
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=16144,i,16939508063295759863,11285280828465422532,2097152 --field-trial-handle=2212,i,1689343121391303368,15503196319945988624,262144 --variations-seed-version --mojo-platform-channel-handle=16168 /prefetch:1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:9524
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4544
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4796
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3088
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1648
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:4108
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:1028
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                              PID:5020
                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                PID:5076
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2328
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5224
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5480
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5616
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5676
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:952
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5128
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3ch0act\7e8fda3z.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:5204
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                              PID:5396
                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                PID:5780
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6120
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:5508
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5436
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6036
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5488
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5492
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cq12ct8b\mh9dzadw.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5576
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                            PID:5260
                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:6076
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6536
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:6740
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6932
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7136
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6740
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:6672
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ini6dffd\mg05y0mr.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6808
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                          PID:6976
                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:7152
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6984
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6356
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:7232
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:7368
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:7544
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tol2ar4m\n5jhjpte.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:7668
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                        PID:7900
                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                          PID:8132
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1312
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:7820
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:8004
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:8092
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7400
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:8144
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xgo9mgfd\pm6oez21.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:648
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                        PID:8292
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:8468
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:8528
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:8600
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:8768
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:9000
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:9112
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0447amka\x85lreds.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:9196
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                    PID:8224
                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                      PID:8476
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:6436
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:9592
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:10048
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:10064
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:9164
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecely5oc\5d77im1q.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1264
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                    PID:4744
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:9752
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:9600
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:9804
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:9876
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:9896
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:10304
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36yf2ap3\k4ch5p9x.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:10376
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                PID:10404
                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                  PID:10448
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:10508
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:10556
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:10604
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:10652
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:10700
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:11052
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\39ovmogk\66drpx7l.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:11144
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j8f6o42\to448keg.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                              PID:9744
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j8f6o42\to448keg.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                PID:10464
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:10544
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:10660
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:10668
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:10724
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:5956

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                        • SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                                                                                        • SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00006c
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                                                                                                                                                                                                                                                        • Size 36KB
                                                                                                                                                                                                                                                                                                        • SHA256 8f996a7b56c1c59052d489fde4ecec9d093df8869775fdf9abf071bbfc25a96e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00006d
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
                                                                                                                                                                                                                                                                                                        • Size 100KB
                                                                                                                                                                                                                                                                                                        • SHA256 a516ff99fc0c417a829fafcf819edd530283856d0d7dff5d6f624afdbc0b436a
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00006f
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
                                                                                                                                                                                                                                                                                                        • Size 280KB
                                                                                                                                                                                                                                                                                                        • SHA256 fd5cd5d4564e179dfd88ffdc8f19a512715083250b9bd17ab65b12084dc8e82d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000071
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                                                                                                                                                                                                                                                        • Size 38KB
                                                                                                                                                                                                                                                                                                        • SHA256 ae1b3b031128f844d86b6ba50b57da647410e99483a5b1ff3542cd9de587c243
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000072
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
                                                                                                                                                                                                                                                                                                        • Size 43KB
                                                                                                                                                                                                                                                                                                        • SHA256 0b14ab9d0e4863752717c058f8c982eb4d624d5e39216664f57d4aab98526dd0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000073
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
                                                                                                                                                                                                                                                                                                        • Size 178KB
                                                                                                                                                                                                                                                                                                        • SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000074
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
                                                                                                                                                                                                                                                                                                        • Size 67KB
                                                                                                                                                                                                                                                                                                        • SHA256 46329ca0cdf320d7b3bf6c6ad81fd16ebbe39fea143c7700f0d809006b144c84
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000075
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
                                                                                                                                                                                                                                                                                                        • Size 75KB
                                                                                                                                                                                                                                                                                                        • SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000076
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
                                                                                                                                                                                                                                                                                                        • Size 93KB
                                                                                                                                                                                                                                                                                                        • SHA256 329ad196557dfb23e145a6eacc674a7711705017fc105ae15487696d86fdf022
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000077
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                                                                                                                                                                                                        • Size 105KB
                                                                                                                                                                                                                                                                                                        • SHA256 d937468e413a53654aed83483338154cb23ca25653fa8d46a989e0c1ab38063e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000078
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
                                                                                                                                                                                                                                                                                                        • Size 158KB
                                                                                                                                                                                                                                                                                                        • SHA256 6c04af325cef515153465cb8b19bb93aec94dcf5d33537f8d95b475cf9284882
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_000079
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
                                                                                                                                                                                                                                                                                                        • Size 205KB
                                                                                                                                                                                                                                                                                                        • SHA256 4c9a35988e43dd60f97a1db4f53cdadb82d0e9cde6ace47d3405e08624ee25fd
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00007a
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
                                                                                                                                                                                                                                                                                                        • Size 219KB
                                                                                                                                                                                                                                                                                                        • SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00007b
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
                                                                                                                                                                                                                                                                                                        • Size 21KB
                                                                                                                                                                                                                                                                                                        • SHA256 a3d8bdb8d4e94c935586972bc44ca6de73f85b2b8b1774bac16d4b337bdcddd0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00007c
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
                                                                                                                                                                                                                                                                                                        • Size 92KB
                                                                                                                                                                                                                                                                                                        • SHA256 192a28957868efbf872db847b27a57818414455acd35e2de97905944e8edc921
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f_00007e
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
                                                                                                                                                                                                                                                                                                        • Size 26KB
                                                                                                                                                                                                                                                                                                        • SHA256 7fb56232581e8ffe13275f4cb61a93856c88658ce4b4aa4f3379b1152c8bea38
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        36fade8541951d08_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\36fade8541951d08_0
                                                                                                                                                                                                                                                                                                        • Size 283B
                                                                                                                                                                                                                                                                                                        • SHA256 5b1cc541d4a0be2ea7732dbe935dc03f558fe6b3fa265396f396adec6571b4e8
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        3fa4a7cfe3b6f84f_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fa4a7cfe3b6f84f_0
                                                                                                                                                                                                                                                                                                        • Size 487KB
                                                                                                                                                                                                                                                                                                        • SHA256 4acd997d7f57db5acc7892e83158ab28ebb43304cfbd490c137f8bd290ef5915
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        5122ae39d44fe2df_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5122ae39d44fe2df_0
                                                                                                                                                                                                                                                                                                        • Size 270B
                                                                                                                                                                                                                                                                                                        • SHA256 1d2931f6ba3c6eb9401efcc26cc1b3474aeff87acedd8d008e69bfeabd078c16
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        53aad3e1af67d216_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53aad3e1af67d216_0
                                                                                                                                                                                                                                                                                                        • Size 59KB
                                                                                                                                                                                                                                                                                                        • SHA256 cbf4cadf9052c8e4bf6dfbb91bf7d07787fa1755105bf6f4017257afd843d7f0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        55be18fec63c7512_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55be18fec63c7512_0
                                                                                                                                                                                                                                                                                                        • Size 304KB
                                                                                                                                                                                                                                                                                                        • SHA256 3f023d77492833fdf666ce8def35105f46c276e0ad0b718baaaac64c9417f602
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        55dfdc7d25089aa6_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55dfdc7d25089aa6_0
                                                                                                                                                                                                                                                                                                        • Size 174KB
                                                                                                                                                                                                                                                                                                        • SHA256 399353bba77a55de90f49466c35142c84010930fc4a65a58aae7d68f13a402a3
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        561d22a8b15a8421_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\561d22a8b15a8421_0
                                                                                                                                                                                                                                                                                                        • Size 11KB
                                                                                                                                                                                                                                                                                                        • SHA256 bfe5234f372fe5d979ab47db670e68bda46381b8a78232b2c8c6383199152af0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        5927214c75660b22_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5927214c75660b22_0
                                                                                                                                                                                                                                                                                                        • Size 404B
                                                                                                                                                                                                                                                                                                        • SHA256 2b48c8d9e5a84ec54aa35674e770e9df20a5ab9a86a2787fa8cd3613bbc39242
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        596d2c9be0227e11_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\596d2c9be0227e11_0
                                                                                                                                                                                                                                                                                                        • Size 583KB
                                                                                                                                                                                                                                                                                                        • SHA256 13935fab92a200dc36c855b257b44a819bb5d97afbab7cf5940a53da6eaced1f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        6e73086a045c2181_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e73086a045c2181_0
                                                                                                                                                                                                                                                                                                        • Size 283B
                                                                                                                                                                                                                                                                                                        • SHA256 128ef8c67f7ed76ccc21fc8bb0a5d8ab79def0caa5e44687a0f870369cca759c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        85f7e24ddd35388e_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85f7e24ddd35388e_0
                                                                                                                                                                                                                                                                                                        • Size 211KB
                                                                                                                                                                                                                                                                                                        • SHA256 5c5475273680af0a9467fc65721833ae2d98f9a9240f0571015f017cc53b11d1
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        85f823e6a5b04c10_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\85f823e6a5b04c10_0
                                                                                                                                                                                                                                                                                                        • Size 24KB
                                                                                                                                                                                                                                                                                                        • SHA256 ba3ac5d7496211c5f647293ce6ca0e32b2247bc6293537e7026e92f9145442e7
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        af3d2d8d4809f23d_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af3d2d8d4809f23d_0
                                                                                                                                                                                                                                                                                                        • Size 112KB
                                                                                                                                                                                                                                                                                                        • SHA256 0a4e3d958063905772746e04952f68be920f62741ba94f8e0a5768db04aedf7c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        b093643cc54cbc30_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b093643cc54cbc30_0
                                                                                                                                                                                                                                                                                                        • Size 602B
                                                                                                                                                                                                                                                                                                        • SHA256 e3504b659893195dc12bcdc1260e902b17e9ba7b4ee5e886a09a659191cd34e2
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        c797022604539ea1_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c797022604539ea1_0
                                                                                                                                                                                                                                                                                                        • Size 283B
                                                                                                                                                                                                                                                                                                        • SHA256 426fe59e8647382563f0e860ede47289ebc7ebdf5e5c7bdcf2e51a9edbde725c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        cb3a083184f96a96_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb3a083184f96a96_0
                                                                                                                                                                                                                                                                                                        • Size 294B
                                                                                                                                                                                                                                                                                                        • SHA256 6c5c05757c4bb22aee1678354ddbcf51b481bcb8f70ac70d7ab005009beab294
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        d89ef2d6c4d62304_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d89ef2d6c4d62304_0
                                                                                                                                                                                                                                                                                                        • Size 283B
                                                                                                                                                                                                                                                                                                        • SHA256 51ba1564062550d50aca85b1baa0ec7ace855cfb4277427fb3ff9a5c0254a4e0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        dbad10004875cd9d_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dbad10004875cd9d_0
                                                                                                                                                                                                                                                                                                        • Size 602B
                                                                                                                                                                                                                                                                                                        • SHA256 425e272997f814c047a724eb2f905ab8a639bd1454da8992069762d7b366b9f0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        eee97d7757f889b4_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eee97d7757f889b4_0
                                                                                                                                                                                                                                                                                                        • Size 283B
                                                                                                                                                                                                                                                                                                        • SHA256 afae92653bacbbfee78dd838a5ceb6bd3b33b37a831465b78e1c36386c9bca6c
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f78b84608f28fc5c_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f78b84608f28fc5c_0
                                                                                                                                                                                                                                                                                                        • Size 81KB
                                                                                                                                                                                                                                                                                                        • SHA256 f4a6a6d96146b157e56e209541cf19327eb165b7a9ac64e4b4ac172f2f0a856f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        f92d9d0812a75b30_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f92d9d0812a75b30_0
                                                                                                                                                                                                                                                                                                        • Size 287KB
                                                                                                                                                                                                                                                                                                        • SHA256 149f3a4b3ae5c807a7ba9d57d0de2447a2f524d34d60bc9da6377346f5641d87
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        fa7dccdfed1aee75_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa7dccdfed1aee75_0
                                                                                                                                                                                                                                                                                                        • Size 319KB
                                                                                                                                                                                                                                                                                                        • SHA256 167eddad0023982cb2eac431d9cfa3f318fb6f9f5ea7328d92687aff00026bf4
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        fc59af036509d30c_0
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc59af036509d30c_0
                                                                                                                                                                                                                                                                                                        • Size 270B
                                                                                                                                                                                                                                                                                                        • SHA256 431ad60e3511e92f3ddafd123c6154779a8fb792b714f8ae0dada85e94f089ae
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Edge Profile.ico
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                        • Size 70KB
                                                                                                                                                                                                                                                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                        • Size 111B
                                                                                                                                                                                                                                                                                                        • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Network Persistent State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                        • Size 111B
                                                                                                                                                                                                                                                                                                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                        • Size 2B
                                                                                                                                                                                                                                                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                                                                                        • SHA256 ce6d871696fe53b2398eb9fc500ee857d4c641b50b424d9d4cb209d0f152b085
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                        • Size 14KB
                                                                                                                                                                                                                                                                                                        • SHA256 e5dcd7bb3b0dcf000135ac52c1fa94501cdb7c33872aa17137edbce7d85a5b4b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                        • Size 30KB
                                                                                                                                                                                                                                                                                                        • SHA256 f2efded6524859d26377f0006de0792ac1d4141439adff2fda5ce06a8b683e72
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        sync_diagnostic.log
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                                                                                        • SHA256 24b96fc3aedfa93fa474c133c80f95539d38e9a29ac7d3c4857f4b8df7796d3b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 6f123fec0ca5078c1077c991c8f630b99baab3f7c9a1e78d7401e58b7d2edd65
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                        • SHA256 7e22b9a5afc9357170c11e832820eca790f01bc6812d2f1ff66978d0793d1393
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 88ecc3ac4f6d9c0098ee99b2a2cded0d15612bf93686256011537d8c22d9ae3d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 3e3f3fb5cdd0de6f94ae64e556506b0da40f7596908fbd8c760a49080cbe0d6b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 abc89218eaac2aefbbdb41b7e74053ccf4e9b5d296fe186cd7c7d214e51be450
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 dc7b6a87e29937e080ef96eaaf234b40b2be42fb13c2516b6b7d8222950b3462
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 3bcea65224060a122490d6c53af772b086d18ea1b68973ef8bb6b138937e8068
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 159b1e03db6111d697c80e65236b2868313db3783a21d5d44d417064cd40cc18
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 542330b40e21a10caff883a9bab0fb777449b5a8a340ad28e17ba97468954478
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 64e64d9f68dca220cc40bd982c4bc2729bf3ca84cde39c2046c15e9bd9954be0
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 ff612b172481fa882e7d7c6a7dff9f62af350c94a5bfb2eb2d93f9f616859dfa
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 0f9901e946af741d8c3dd650c672676d58653a2e8cdf52508804d3b23f59dfdf
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 a3085ab19c927565aeb68b9937a7f437917e7d6f3498fac9a988829c31d119c7
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 72bfb541dce7afc786d07115505f7752e9764ae401b3b8e512580c90dc6c29a2
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 b321bd49b12f083869314a6a1b8b009de195ae01a3601c500cd557acbce74f2e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 74a3193123a13d9374073e6566ae74fe53bb5ba1130ae4cde1f40d45b2a1162d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 453f90a2f28c328c5edca8a87de4212b09faa91421130400fb256f86d69d5f62
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 8b4c91892fdb10de1107bba8d49c1a9ec0212cd2adbb8ad9af763917b6db74c9
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 5b75073717e597555f0a046a48f4ef86aaf3c6e78ed3947f2ccc9fe3546c5478
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 28939cc32e8e7b737834669bffe99afed17da28ca81ac983d7dd7adec6ccf72b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 06fde44cd71789ddb352935d128b24801e4fcace14c98e6341571e3dcf061d79
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                        • SHA256 f0f27ab44ecc8cd0007b0700fd34e3246b189c80f3134d40aa6d256f479f0702
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 b4a7de3b1e2f83239c1ce7642f459f8385433116e8cf56886af2d2a0d917e220
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 8422d1fd7fb2bc9ed82b85bf2a8604e8e8664975d03805ab311f95cfad6b27b4
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 114c5b15c9f5ce8cee3a909f04542e47f8fc2002f9ad740f648ece6994f62e05
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                                                                                        • SHA256 fc107b5c64e814fc8e50eff14f88f780d6c8e146c7c062f336a6c6ff96d40431
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 9KB
                                                                                                                                                                                                                                                                                                        • SHA256 39093ffa91f171e62c3c1645f7a223bee4dc4d0eabada13777e4398a4a838470
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 20b66ef7162dcebf8915f6d85efa4c1b7e5dd0f772fa74c721136f9edeb3e029
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        e7752fc4-fc60-4c7f-9df4-0c884f4b9f8a.tmp
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7752fc4-fc60-4c7f-9df4-0c884f4b9f8a.tmp
                                                                                                                                                                                                                                                                                                        • Size 12KB
                                                                                                                                                                                                                                                                                                        • SHA256 5a97fbd0fc4765a1f9ffb9b961fbed05701efc861b90121caa984a8c47d4f3f4
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        2307ecf8-e27c-41aa-80b7-7fea28089a8b.tmp
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2307ecf8-e27c-41aa-80b7-7fea28089a8b.tmp
                                                                                                                                                                                                                                                                                                        • Size 13B
                                                                                                                                                                                                                                                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                        • Size 94KB
                                                                                                                                                                                                                                                                                                        • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _bz2.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_bz2.pyd
                                                                                                                                                                                                                                                                                                        • Size 84KB
                                                                                                                                                                                                                                                                                                        • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _decimal.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_decimal.pyd
                                                                                                                                                                                                                                                                                                        • Size 265KB
                                                                                                                                                                                                                                                                                                        • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _hashlib.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_hashlib.pyd
                                                                                                                                                                                                                                                                                                        • Size 64KB
                                                                                                                                                                                                                                                                                                        • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _lzma.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_lzma.pyd
                                                                                                                                                                                                                                                                                                        • Size 159KB
                                                                                                                                                                                                                                                                                                        • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _socket.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_socket.pyd
                                                                                                                                                                                                                                                                                                        • Size 78KB
                                                                                                                                                                                                                                                                                                        • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _ssl.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_ssl.pyd
                                                                                                                                                                                                                                                                                                        • Size 151KB
                                                                                                                                                                                                                                                                                                        • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        _uuid.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\_uuid.pyd
                                                                                                                                                                                                                                                                                                        • Size 23KB
                                                                                                                                                                                                                                                                                                        • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        base_library.zip
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\base_library.zip
                                                                                                                                                                                                                                                                                                        • Size 711KB
                                                                                                                                                                                                                                                                                                        • SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                        • Size 3.3MB
                                                                                                                                                                                                                                                                                                        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        libssl-1_1.dll
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                        • Size 678KB
                                                                                                                                                                                                                                                                                                        • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        python39.dll
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\python39.dll
                                                                                                                                                                                                                                                                                                        • Size 4.3MB
                                                                                                                                                                                                                                                                                                        • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        select.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\select.pyd
                                                                                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                                                                                        • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        unicodedata.pyd
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4362\unicodedata.pyd
                                                                                                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                                                                                                        • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                        d6l2fz6q.exe
                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ms16a2kq\d6l2fz6q.exe
                                                                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                                                                        • SHA256 02fcb40dab2c23eb0c5d3ac83713fe003f65cf2fec949fbf4c80244056ee9b6b
                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                        Submit Download