859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235

Analysis

max time kernel
60s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
Size 5.4MB
Sample260818-sd3ecacq6z
SHA256 859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235
MD5 1e2d6e843cc635d42d7e6e9a07126244
SHA1 573a3abb5a30aa168417de00a712c32ec8b3c1ca
SHA512 849b6774a22c7a99003b20a9ca8bd52ba0514433972d92a9253cc17190fdd20122807ea845ca948f39db83a5b2093a969e44fc2d8d08f25d8da5fcaa40d71c11
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6u8:AsTICteErownP0oTcMsABqljkV
TLSH
T1F3463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9219
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3120
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8670
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1036
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2567
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5612
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9175
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4109
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2919
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4445
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8410
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9332
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3660
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4659
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2736
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1900
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6726
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5397
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8734
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7940
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9260
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2890
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1891
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3278
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9644
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4205
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7215
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6782
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5926
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1488
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9461
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3623
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7509
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6290
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2016
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9534
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3941
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1276
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4495
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7350
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5303
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8515
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1220
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4806
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7038
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2812
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7621
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6150
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7110
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5689
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9582
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4315
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3366
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7363
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3306
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3742
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4510
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9221
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3682
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9996
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3462
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8226
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3291
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8200
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5364
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1564
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5065
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3458
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4222
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7469
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4737
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7878
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7816
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6628
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6904
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6359
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7610
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5371
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8924
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1413
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4503
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3079
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4650
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7945
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3938
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5930
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3917
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6240
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4446
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4572
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9123
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6620
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3544
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8265
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3128
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7593
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9484
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2060
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2854
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2676
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1962
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4421
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7306
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2239
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2888
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6889
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4901
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6814
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2891
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6671
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6916
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7986
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3101
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3441
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7824
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1990
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4809
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7781
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7020
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4838
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9795
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2665
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5589
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8182
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6757
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2129
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3202
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7670
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3816
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2341
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1355
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4467
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1204
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1715
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4310
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6659
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8657
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2058
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1723
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3311
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7142
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1693
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5712
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9126

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvfkk4.exe	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvfkk4.exe	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fymgj5.exe	v8dg2mwm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fymgj5.exe	v8dg2mwm.exe

Executes dropped EXE 2 IoCs

pid	Process
3692	v8dg2mwm.exe
368	v8dg2mwm.exe

Loads dropped DLL 23 IoCs

pid	Process
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
368	v8dg2mwm.exe
2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\e34xwwov\\v8dg2mwm.exe"	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\0q94h7k1\\kdc47whd.exe"	v8dg2mwm.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
891	ifconfig.me
902	ifconfig.me
1201	ifconfig.me
2449	ifconfig.me
165	ifconfig.me
188	ifconfig.me
299	ifconfig.me
303	ifconfig.me
448	ifconfig.me
2184	ifconfig.me
3022	ifconfig.me
3058	ifconfig.me
415	ifconfig.me
175	ifconfig.me
179	ifconfig.me
334	ifconfig.me
355	ifconfig.me
398	ifconfig.me
436	ifconfig.me
937	ifconfig.me
154	ifconfig.me
232	ifconfig.me
335	ifconfig.me
1569	ifconfig.me
1748	ifconfig.me
2447	ifconfig.me
363	ifconfig.me
757	ifconfig.me
1093	ifconfig.me
1130	ifconfig.me
1197	ifconfig.me
1245	ifconfig.me
1262	ifconfig.me
1445	ifconfig.me
518	ifconfig.me
629	ifconfig.me
771	ifconfig.me
885	ifconfig.me
1238	ifconfig.me
1632	ifconfig.me
2285	ifconfig.me
98	ifconfig.me
131	ifconfig.me
1024	ifconfig.me
1308	ifconfig.me
2250	ifconfig.me
2640	ifconfig.me
255	ifconfig.me
1847	ifconfig.me
2829	ifconfig.me
34	ifconfig.me
71	ifconfig.me
2453	ifconfig.me
2965	ifconfig.me
406	ifconfig.me
468	ifconfig.me
1442	ifconfig.me
1594	ifconfig.me
2206	ifconfig.me
420	ifconfig.me
696	ifconfig.me
1180	ifconfig.me
1615	ifconfig.me
2774	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 17 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
9968	cmd.exe
10732	cmd.exe
9956	cmd.exe
11384	cmd.exe
5412	cmd.exe
5984	cmd.exe
8068	cmd.exe
10096	cmd.exe
568	cmd.exe
4916	cmd.exe
5908	cmd.exe
6188	cmd.exe
3760	cmd.exe
2960	cmd.exe
3288	cmd.exe
6872	cmd.exe
8216	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4656	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3532	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2248	2468	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	89
PID 2248 wrote to memory of 2960	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	91
PID 2960 wrote to memory of 2548	2960	cmd.exe	93
PID 3692 wrote to memory of 368	3692	v8dg2mwm.exe	96
PID 2248 wrote to memory of 3532	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	97
PID 368 wrote to memory of 3288	368	v8dg2mwm.exe	98
PID 2248 wrote to memory of 564	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	100
PID 3532 wrote to memory of 2108	3532	msedge.exe	101
PID 2248 wrote to memory of 2028	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	102
PID 3288 wrote to memory of 1044	3288	cmd.exe	103
PID 2248 wrote to memory of 4592	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	135
PID 3532 wrote to memory of 4656	3532	msedge.exe	105
PID 3532 wrote to memory of 4156	3532	msedge.exe	106
PID 3532 wrote to memory of 1124	3532	msedge.exe	107
PID 3532 wrote to memory of 4156	3532	msedge.exe	106
PID 3532 wrote to memory of 1124	3532	msedge.exe	107
PID 3532 wrote to memory of 1124	3532	msedge.exe	107
PID 3532 wrote to memory of 3416	3532	msedge.exe	109
PID 3532 wrote to memory of 3416	3532	msedge.exe	109
PID 3532 wrote to memory of 3416	3532	msedge.exe	109
PID 3532 wrote to memory of 3372	3532	msedge.exe	110
PID 3532 wrote to memory of 3372	3532	msedge.exe	110
PID 3532 wrote to memory of 3372	3532	msedge.exe	110
PID 3532 wrote to memory of 4260	3532	msedge.exe	111
PID 3532 wrote to memory of 4260	3532	msedge.exe	111
PID 3532 wrote to memory of 4260	3532	msedge.exe	111
PID 3532 wrote to memory of 4556	3532	msedge.exe	112
PID 3532 wrote to memory of 4556	3532	msedge.exe	112
PID 3532 wrote to memory of 4556	3532	msedge.exe	112
PID 3532 wrote to memory of 3384	3532	msedge.exe	113
PID 3532 wrote to memory of 3384	3532	msedge.exe	113
PID 3532 wrote to memory of 3384	3532	msedge.exe	113
PID 3532 wrote to memory of 4492	3532	msedge.exe	114
PID 3532 wrote to memory of 4492	3532	msedge.exe	114
PID 3532 wrote to memory of 4492	3532	msedge.exe	114
PID 3532 wrote to memory of 1420	3532	msedge.exe	115
PID 3532 wrote to memory of 1420	3532	msedge.exe	115
PID 3532 wrote to memory of 1420	3532	msedge.exe	115
PID 2248 wrote to memory of 2348	2248	859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe	116

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7432	attrib.exe
1044	attrib.exe
5656	attrib.exe
8172	attrib.exe
10028	attrib.exe
10148	attrib.exe
10932	attrib.exe
2548	attrib.exe
2904	attrib.exe
5540	attrib.exe
10128	attrib.exe
6268	attrib.exe
9536	attrib.exe
2128	attrib.exe
5400	attrib.exe
7252	attrib.exe

C:\Users\Admin\AppData\Local\Temp\859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
"C:\Users\Admin\AppData\Local\Temp\859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe
  "C:\Users\Admin\AppData\Local\Temp\859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe"
      4⤵
      Views/modifies file attributes
      PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffc31bac188,0x7ffc31bac194,0x7ffc31bac1a0
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,12854620333485717290,10142718344236711564,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
      4⤵
      System Time Discovery
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,14225830098574922655,15516677722666866140,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16790255801896436017,7280510761427427409,262144 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,10081748238948649359,6207363261407584064,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,8150137925747619251,17925108975896463728,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,7481375898403241830,884450613139662237,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9589013461770158774,11389144389453207746,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4524,i,17401435891975060264,13588555783968941382,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4916,i,16120225836905677033,10553713644086728358,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5064,i,8238002395744427237,17534455979098631398,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5664,i,5854113716248084544,14925781412799434908,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6438167102534061169,14704554893913629152,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5796,i,4834510063878454368,4517287907314957152,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5836,i,9048914718327336440,10977648005056297622,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3448,i,7345085844512512961,4129265369728538174,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5932,i,9980720852476878341,4182238632108751329,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5964,i,8817579460970108555,17955456917084311362,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5544,i,9739590648570577344,2341018476978287137,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,15299976326138110543,17406751112343134136,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,8002223715785050621,2015311531356095395,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6156,i,3760716340728367618,6110986194356500376,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6304,i,11569565785616562322,8372756930204813000,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6288,i,5585440664220178045,1846952440567617731,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6348,i,5391146328553799958,5233594105641076972,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6280,i,13772951103258034982,3715457051316584298,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6812,i,10435401753245905248,16703448752948887012,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6796,i,6883797609892043807,9557814457067515400,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6780,i,2101995048509536125,1441757273874018172,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6768,i,17061270203564521331,5502357850608741856,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7084,i,1993265382476616151,4312636929447267525,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3337364126669725018,16031212373223345253,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:8
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,3337364126669725018,16031212373223345253,524288 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=9444 /prefetch:8
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9928,i,5621464235867725886,3809379342140733973,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=9924 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=10092,i,11833857384147329812,5468994900795895740,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10172,i,7684911148478520385,13924844746581978876,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10300 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10464,i,71415672146218229,2962777520375573476,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10456 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10648,i,16836785341022185398,12303547625777095062,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10812,i,16696475805670706978,17251167497048572188,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10824 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10848,i,17547639405997871538,6430570522244084498,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=10664 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=11148,i,15825188237007354485,10947579433524674722,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=11352,i,612343737922213545,10217525887245391423,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=11364 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11532,i,13893547298597134887,8893730642851972819,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=11536 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11708,i,4676931512397827581,5358932370235656357,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:1
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11864,i,2187384236189185717,17362696370265997020,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=11868 /prefetch:1
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11712,i,9719202850302047641,12279621233441265881,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12020 /prefetch:1
      4⤵
      PID:6748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=12188,i,6934677174077560637,12116911026392102328,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12172 /prefetch:1
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12372,i,16007004234477268663,6067144310693154792,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12376 /prefetch:1
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12592,i,6347158543120868065,9049723619784950643,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12604 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12760,i,14638593510564194457,7884808873074806696,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12300 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12792,i,5264501860709056376,5164808871883176964,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=12936 /prefetch:1
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=13068,i,6012345327883744285,2859046939391860751,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=13096 /prefetch:1
      4⤵
      PID:7156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=13272,i,425582894952332928,9502362734508588498,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=13296 /prefetch:1
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=5540,i,3139716354153221516,18339197891813976132,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:7464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=13576,i,8781502283874687390,10778293906360197962,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=13588 /prefetch:1
      4⤵
      PID:7520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13732,i,7444789222744452755,12015273176710340094,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=13748 /prefetch:1
      4⤵
      PID:7652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13936,i,3495572087378773303,13078556757556200614,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=13932 /prefetch:1
      4⤵
      PID:7780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=14132,i,9125553363921144798,7166028996566388627,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=14156 /prefetch:1
      4⤵
      PID:7968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=14296,i,16037247003661092594,15574853879283802765,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=14304 /prefetch:1
      4⤵
      PID:7440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=14512,i,423885852422011141,8653790078949942951,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=14484 /prefetch:1
      4⤵
      PID:7792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=14672,i,17969035301773794799,1217813039889471133,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=14536 /prefetch:1
      4⤵
      PID:8000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=14656,i,3373939917686183729,709781210412120733,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=14612 /prefetch:1
      4⤵
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=14860,i,7798817255251859215,6138106318936638649,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15028 /prefetch:1
      4⤵
      PID:7448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=15180,i,884046415396798632,14215745705185664196,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15188 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=15340,i,6406092029359180686,15579627343335318744,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15376 /prefetch:1
      4⤵
      PID:8200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=15516,i,6306253098563284564,6204956935461693825,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15528 /prefetch:1
      4⤵
      PID:8340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=15688,i,13472329844390968425,2153766440294497763,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15684 /prefetch:1
      4⤵
      PID:8380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=15820,i,16268646590337174746,959792036094006597,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=15832 /prefetch:1
      4⤵
      PID:8420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5700,i,3369473044971115561,689343874395843840,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16004 /prefetch:1
      4⤵
      PID:8576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=16128,i,14115701821372152188,5142065195617689433,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16192 /prefetch:1
      4⤵
      PID:8784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=16324,i,6953018389218927877,10905504485470399872,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16336 /prefetch:1
      4⤵
      PID:8792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=5948,i,15539017480996096550,1759543826224867021,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16380 /prefetch:1
      4⤵
      PID:8944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=3632,i,17520579895436427800,14964795665129357047,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16648 /prefetch:1
      4⤵
      PID:9068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=16792,i,16749741396359113316,5759181729269979827,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=16804 /prefetch:1
      4⤵
      PID:9108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=16984,i,13171792496997254947,8875229042596472329,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:8232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=17136,i,5873109909021474089,16231566312567862319,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17084 /prefetch:1
      4⤵
      PID:8740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=7068,i,5716541092970910968,5216185437892176306,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17232 /prefetch:1
      4⤵
      PID:8780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=16664,i,15557776078000617910,17994239688406963156,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17416 /prefetch:1
      4⤵
      PID:9228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=17612,i,855809232994702439,2821595781098486598,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17400 /prefetch:1
      4⤵
      PID:9280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=17432,i,3843177800958200683,4691113727474121695,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17752 /prefetch:1
      4⤵
      PID:9344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=10076,i,18120600428229899371,9879746557033665584,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=17896 /prefetch:1
      4⤵
      PID:9456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=9328,i,10095117111227580777,15244851568939231505,2097152 --field-trial-handle=2404,i,5541777134462171314,14145613846619299716,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
      4⤵
      PID:9556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2348

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe"
      4⤵
      Views/modifies file attributes
      PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3460

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe
1⤵
PID:2916
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0q94h7k1\kdc47whd.exe
  2⤵
  PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:568
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe"
      4⤵
      Views/modifies file attributes
      PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4592

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe
1⤵
PID:2788
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l5hstj20\qub3kkpv.exe
  2⤵
  PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4916
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe"
      4⤵
      Views/modifies file attributes
      PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4140

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe
1⤵
PID:4468
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fyzba8dv\oze8fdnm.exe
  2⤵
  PID:5272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5412
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe"
      4⤵
      Views/modifies file attributes
      PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5188

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe
1⤵
PID:5768
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hcai1aeg\dvuc85h7.exe
  2⤵
  PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe"
      4⤵
      Views/modifies file attributes
      PID:5400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6268

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe
1⤵
PID:6092
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8exa2z56\8cry0jrl.exe
  2⤵
  PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5908
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe"
      4⤵
      Views/modifies file attributes
      PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6960

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe
1⤵
PID:7060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f6yg42uy\mro6a141.exe
  2⤵
  PID:7160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6188
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe"
      4⤵
      Views/modifies file attributes
      PID:6268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6196

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe
1⤵
PID:6716
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vjlqfuo6\3rsqtuse.exe
  2⤵
  PID:7136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6872
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe"
      4⤵
      Views/modifies file attributes
      PID:7252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7948

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe
1⤵
PID:7772
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35fcc08v\kram16t4.exe
  2⤵
  PID:7932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8068
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe"
      4⤵
      Views/modifies file attributes
      PID:8172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7192

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe
1⤵
PID:7584
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kn3ajq78\mrwh2upr.exe
  2⤵
  PID:8076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3760
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe"
      4⤵
      Views/modifies file attributes
      PID:7432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9096

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe
1⤵
PID:8656
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ly1ruf7e\frhj6kvt.exe
  2⤵
  PID:8968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8216
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe"
      4⤵
      Views/modifies file attributes
      PID:9536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10224

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe
1⤵
PID:9796
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ar7dkpjl\xmocq573.exe
  2⤵
  PID:9920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9956
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe"
      4⤵
      Views/modifies file attributes
      PID:10128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2832

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe
1⤵
PID:7192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ijptd99f\l6snrmoy.exe
  2⤵
  PID:9864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9968
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe"
      4⤵
      Views/modifies file attributes
      PID:10028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9812

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe
1⤵
PID:9580
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ylhvi5kp\mqlj07ft.exe
  2⤵
  PID:6304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe"
      4⤵
      Views/modifies file attributes
      PID:10148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10412

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe
1⤵
PID:10496
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rnxppdnm\0zql59fk.exe
  2⤵
  PID:10620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10732
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe"
      4⤵
      Views/modifies file attributes
      PID:10932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe
1⤵
PID:10524
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2gmjfu7w\0g3635x4.exe
  2⤵
  PID:7312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qnahfwrv\jjokm1fs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 171b4fb2588861026c774c0935c06f774069fad2815133e9f3a833e1f8ba421a
MD5 cf056e63f621a89d65fc13f215950d06
SHA1 9dc597bdf240385b6824a9ce97f6e3fcb02de1b3
SHA512 cbf1f2e5b0ac2fb64a393460c67d5229a39554abd20c01d2ac1bc0f6e0cb0089cc0478c102efcc3c617f3912dc46a479ec0b4e0a23ca055b0d3e82ec3d043c0c
SSDEEP 192:sxZ9RWjp/fhsPCy9EdpN2HW6+WNiHkFjv/YCurJSIgyJ:sxZ94p/fhsPCyW8Hbdl/AkO
TLSH
T1CD22CA526E3865774CCBE21DBA157F53D2F9503291D51E98EBFC861C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a013206e1cdf1cb78bd0a329b0b21311538467b95e947c4cca567c1c4310b264
MD5 c9c075ad04fbf5d21b6662f42e16ffaa
SHA1 2e574d0bb41aa25d1bee6bcaee4b0ed9ff4f9837
SHA512 a6a384649c55f48aae245b1ff5996f0cdc2069bd6d6b35fcc01347db9322a9e9142e92f2340471c69a4fe0dafc2d75635aca431275b83c9660620b8afd73db25
SSDEEP 192:sxZ9RWjp/fhshCiFEdp50gzFJ/W6+WNiDjL+lzjAhYBnFXrJSIg5pJ:sxZ94p/fhshCiuNPb2YghckV
TLSH
T1C232D9566A38A97B4CCBE319FA15BF53E2F5402291D51E98EBFC862C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c861434b4cec34d27d0bfbb6f7cb8635a51e552d84c5e498b92a42589726b3e1
MD5 4de31ff8de939f131997b1dfc73250fc
SHA1 bfc430191975a1d367bef65ec6e22dca5ee18063
SHA512 afcb9fe5097f3a33028cb9011fd683a2260877ff25b19159de2fccd22a551a081a789abc74c80b89cb17c673e00ae996e7ed776428828b306c823f7ab0d92e2b
SSDEEP 192:sxZ9RWjp/fhshCiOEdp5NgzFJ/W6+WNiDjL+lzjAhYBnFXrJSIg5pJ:sxZ94p/fhshCiRqPb2YghckV
TLSH
T1C932D9566A38A97B4CCBE219FA15BF53E2F5402291D51E98EBFC862C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ceb8c54323db354bc92144faefb41b8bb67233de0894849497488acc73c483d7
MD5 a0a9622d9da3b92fa23508c0829388af
SHA1 6c324c70be9fc9cdd07404bf195b0c335a8cb7f0
SHA512 e223dab8e1c1e76537f5fc91eedc032f20ee378ad1d3efc80388d0ea7696620c30b38247e2f642b1d535daf79b3a5d393289a188066b04ba8820a01b183c5cca
SSDEEP 192:sxZ9RWjp/fhshCyvEdpNuzHW6+WNiShD+lZYC67rJSIg5pJ:sxZ94p/fhshCy8OHbNQZCkV
TLSH
T1E532C9566E38A57B4CCBE219BB15BF53D2F9403291D51E98EBFC862C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 74ed4f1199e22ec0f35347a159eab70fb6b715eb2ef89088752eacc106a51145
MD5 63323821f3d5edbe95bfbe25b9f2ee74
SHA1 6cbc22cdcfeedc6df797f339a8b83323df1be8ef
SHA512 c381376ace6c847e7c3c40ef67029cc9c75ff05bc46f5140873fa676b4510f201cbdafa74251d904b12a37625715706097f95170a945857235888254ee6debda
SSDEEP 768:39qbUm+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrYro01:39qbUm+WvSCU6u1jaaZLbWrjS
TLSH
T175C2E93F340CCA7E4FC01A9DDD5A6F972E9802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 21fb12f728dac6b4179d90c9703629b3b1954b7acd68f2cc030f304eaec5c3fd
MD5 82f3b2fa84240a0076e543e019556ebe
SHA1 67680d77c47660805f772d7114bce9f5998c8805
SHA512 9d71e63d97fe14b5e045238136dc4dbb896ba958f248dc8f1e94f426f3bae7f8be6f9a1e1be6c2a45386faf095cbeb1f237177a1b53e04001ee9302839557177
SSDEEP 48:K0TQ3D5FRkhFmPIm7kKfBX5jsnTRtZkpt6PI6bkK/BH5kLz08aRz5yxoIvKx2Etx:KEIgKJB0QKp+ayoAKx2+nqKoUeg
TLSH
T167A13306797B53022CBE6448BAA696775F9631A33014F4AF7FB900620E6BE215CFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ff346199dccb786b27a9192ef4b4b84d9c9bb3462c226df519d664e0692f719a
MD5 576a48fc1cb34a1c6c33c80652d58322
SHA1 9bab7280c24b2b612418e274a7d2ca3fa32b337f
SHA512 a10d125bea2ad0343b4713b2523bac2b4c667decaedf2f1a0dbd56d06d67e4f40199bc0c99fbd93d6e8f05460eca260b146a5c1b7696716e9a1d81e58a551a0d
SSDEEP 192:zGsNlhQRVV6bi8XQmiU1hLQ11Ea+jROmDRk9NmnqblRk35z2:zGsNlhSVVXCTQPEa+NOjGqRk3k
TLSH
T17B422A3179399C3689F7A548F48B37579FB850B7D8869F94D9CA9F1D00D728C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d08afc26012b658cad4c74ec1b6af1d5d8a3ad5909409c55184293ae3a2a0b0b
MD5 b36a4391e95405fd8c1542bca04ce7d7
SHA1 2d35221240eaacc9eab3b44971459d9a000eab1c
SHA512 f94ed28687fc0f46cf5c360f958400d2d14f45db850a325a15cb51e417c29c9ceeccb55b61b316d313d4d8084ad04a5f780273f8e81b4213d8ca1e82bceff065
SSDEEP 192:zasNlZQRVV6bi8PQmiU1RLQogEa+jROmDRk9NmnqblRk35z7:zasNlZSVVXoPQPEa+NOjGqRk3h
TLSH
T1BD423A3178399C3288F7A148F48B37579FB810B7D8869F94D9CA9F1D00D728C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ebf8281433a058456f227802598a6e90c621733f5baf35e8d05c2400d6b84f1f
MD5 ef85e91e119942cb021005854b00e1bb
SHA1 ca9d8226e22398f5c64169b247f9bc2a68fc3f68
SHA512 c88d5dc88b30e12ab0d8447e34774c37aae75dd79625dfc838c9f94b5718a9df080ab4b0380c45d44d2eaebb541b3141c9e679d59ee6a5627696f1e382c4a103
SSDEEP 192:zasNlZQRVV6bi8QQmiU1MLQHrEa+jROmDRk9NmnqblRk35z7:zasNlZSVVX5qQLEa+NOjGqRk3h
TLSH
T15D423A3178399C3688FBA148F48B37579FB850B7D8869F94D9CA9F1D00D728C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ffe855f08e22884f7bef463c2883e1df1c3697fcfa166f85f9cd14001ba7baac
MD5 6dd154da2c2d5f1e61790c71cfcf102f
SHA1 324859b10ca6e8064b130a9306125bd0b52e8c52
SHA512 58d0a692237c084308c3953c99ded1edd1194069ab1b3c03182ccea3b65573d4e04e53c42d6b377fd34c1e508ed9c5a8d8674308b1a1130d10b7178dd0845f97
SSDEEP 192:zpsNlrQRVV6bi8iQmiU1SLQYgEa+jROmDRk9NmnqblRk35zk:zpsNlrSVVXjgQ1Ea+NOjGqRk32
TLSH
T16B422A3178399C3298F7A648F48B37539FB850B7D8869F94D9CA9F1D00D729C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0347b901ffcd37f780cb051aac0babf10aedd1bca77fe8251d047b756ade20c1
MD5 bffb6456f54aae5e2e8d4a71a77383dc
SHA1 6624df192d800afc3ba23d0be973020accb1e584
SHA512 de67582a5a37bd728f4779099c772c0c54281746af8e7e7a6414ea23a46227a7ed21e94147e7aff1b905352909f424f6e0c99f7487a6c47bc21606ab902776c3
SSDEEP 192:z7SsNlrQRVV6bi8DQmiU1cLQi2Ea+jROmDRk9NmnqblRk35zk:zWsNlrSVVXw2QxEa+NOjGqRk32
TLSH
T19F4219317939AC3298FBA644F48A37539FB850B7D8865F94D9C99F1D00D729C234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 027115a8ffe4680a4f2500ba175b30dc0eae790b6f585fc2061b255f64b8e3ef
MD5 d7bc634997bde1937cefe0f6d350e859
SHA1 ebd8506244ddba9936f4e3acca5d567aa4c429d7
SHA512 8f811252e43a395771dc94523d06696ce1acae47e27a03736fbb90a14ae5a093cdf7b6c88e7d879fde6839dc4f668e4de6ba41bda05f9d103df4d88fe2bc2da3
SSDEEP 192:z7TsNlrQRVV6bi8tQmiU1CLQSbEa+jROmDRk9amnqblRk35zk:zvsNlrSVVX6cQYEa+NOj/qRk32
TLSH
T13B42297178399C3298F7A245F48B37539FB850BBD9865F94DAC99F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 54ae68745d3843c53404522822640a1b6e7c595839d6a42e5ae27b6cbd6afcdd
MD5 c5a472edaa798f4213f7ec3b3498594f
SHA1 76fdc5d744012397c5a7f6ae92faa50501935232
SHA512 040729988e9d03647adb42721f929e98abf73d8bbf05e86872aa69c984af0e579b8f76665a1fbed3417bfbb62bbe10e23374f9972ee048089342ba04956c5afb
SSDEEP 192:z7QsNlrQRVV6bi8GQmiU1vLQhoEa+jROmDRk9amnqblRk35zk:zcsNlrSVVXLhQmEa+NOj/qRk32
TLSH
T12C42197178399C3298F7A244F49A37539FB850B7D8865F94DACA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c7d36c187ae9a7526981ec132479bba7e1e76df92ac5b8af652f577c4bdc6613
MD5 8877841fc6caf55190d4dc54cd83e582
SHA1 38ce333e5a4cb763575541e08371df556450e664
SHA512 282aebba40e76709a8f945b13fbd9b442e41d0e7472e1837c77f268bd9235590d83e5e3185aeb2f9d969f8449f4a089d601e6c80cc746f21de3e5ab722e5d6cd
SSDEEP 192:uu7hsNlrQRVV6bi8zdQmiU1LLQVkEa+jROmDRk9amnqblRk35zk:nlsNlrSVVXEblQeEa+NOj/qRk32
TLSH
T16C42193178399C3258F7A644F49A37539FF850BBD9865F94D6C99F1D00DB29C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c85a5a4e938c90108a66c4cd16292070191b049dcd1516f5fe449725e31d97d2
MD5 58df670ca2c551a50eba01368f739827
SHA1 592193cebb4b01681e103c28200f5695837a5a2d
SHA512 734c2bb6d96391b606d1de570dbd3b0dbeb4da7ab05323c7179e503bf76bcc3c03eddcaac9d3404014af24b9a4048760e7a1ea225bc6fe8b4e1bdc696e6309d2
SSDEEP 192:uu79sNlrQRVV6bi8wQmiU1DLQI9Ea+jROmDRk9amnqblRk35zk:nxsNlrSVVXRxQwEa+NOj/qRk32
TLSH
T18A42193178399C3258E7A644F48A37539FF850BBD9865F94DACA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ddfc7597729f46ea08e255a07abc24ee097968186ad46d58d22691061b4a6f8f
MD5 d95785fd0b8e02a8bd2a5fe4feaf121f
SHA1 ef2a6323a502d87fb5b625f343935b7ce51af026
SHA512 2ff54c43043773fd2485c2c71a93591bd18dbf48b9c50282eb82f8376c1dc84a276789a774e372f0d91c7d3ba3212e5ec6b6217590cc0c07f396628f00c12c94
SSDEEP 192:uu79sNlrQRVV6bi8SQmiU12LQnKEa+jROmDRk9amnqblRk35zk:nxsNlrSVVXTsQKEa+NOj/qRk32
TLSH
T1D5421A3178399C3258E7A544F48B37539FF850BBD9865F94D6C99F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f32b5983b5feba44b0cb25fb988f1a2897195a2ead088d9aef7a9ee6bd617ec0
MD5 9653d99a9f124e6c05704ea8194f1c72
SHA1 5b9a30005ac75c71c4bb339fe81f6ad5b80dbc2a
SHA512 fd998e788158cc1c5fd719e76baa63f9e8725a76ee62788b50f55a3cb77d2c1cbd1883e34b6a3426e929ebf7bd59ba89134bab40322374289bc7b4ea8f24861a
SSDEEP 192:uu71sNlmQRVV6bi8MQmiU1eLQzstEa+jROmDRk9amnqblRk35zk:nBsNlmSVVX10QzMEa+NOj/qRk32
TLSH
T14C42193178399C3259EBA244F48A37539FF810BB99865F94D6CE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 77268f7574ca41224a267c7c57ad181c5ae6d046493c0311ffcd168f30a8bbff
MD5 3ae59dd86ab85f279ad9c9c23a71c391
SHA1 3f1b05bfb8277577cf050e82705979e4d3f98665
SHA512 b9827fca3a69dd3c58d16c97dcb59382f0347efa5b48360965ee0b8b225ef3eff6ec38f6b70ee0de0081ba3d1ea394060d55e57447184e0c710c2502cb377fe8
SSDEEP 192:uu70sNlmQRVV6bi8hQmiU1ULQ4tEa+jROmDRk9amnqblRk35zk:nosNlmSVVX2SQ0Ea+NOj/qRk32
TLSH
T15142193178399C3259FBA244F48B37539FF810B799865F94D6DA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ebcc601bfd90e082fd114741ee8a74a951deb7a6923beebbbd120dd82a15cee7
MD5 a5881170cd604ac635073a729a45df7c
SHA1 20bb5be86de98dd7f4a54f86ca3ee051d90999d7
SHA512 18a05013d5ba77f9451c7bf9e8b7b4ea8ec95a8a391b1a4044180fa921854a74ecc54acf1ddab9ad1632672e09860a4f32a5acfbe7a54a4163fcec7ff2ba9463
SSDEEP 192:uu7VWsNlmQRVV6bi81QmiU1ILQ0hEa+jROmDRk9amnqblRk35zk:nksNlmSVVX+eQkEa+NOj/qRk32
TLSH
T1294219317839AC3259EBA644F48A37539FF810B799865F94D6CA9F1D00D739C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 62a4517ccd7b16bb4bb7a86568a27af6d9409791b22c3ca219f7501f8edd9e3c
MD5 80b01bb81f370ae8f73a94e6a5fcc272
SHA1 475ba7bf4e26b910d22a54e4e2871a269327be63
SHA512 9a32334c95ecb1a9e5dd422cd5e3353a7a93517f4cb6e2e8bb643526584eaee62ca969d888d949eb9e89de54992d0bf8ee5e519759753a434c6a5418c8539401
SSDEEP 192:uu7gsNlmQRVV6bi8dQmiU1dLQjuEa+jROmDRk9amnqblRk35zk:nUsNlmSVVXyzQ6Ea+NOj/qRk32
TLSH
T1A84219317839AC3259FBA244F48A37539FF850B799865F94D6DA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 93eab8c54bf9ce2df2f307a73e1b923461fc5754f38599540c0ad2fb411c0ea2
MD5 ddb64dc87a52977daa1ccb92f3b97bff
SHA1 c10eb81345f7d135a7fb12ddedbdf00eb84994c9
SHA512 e2de5fffeaa6dda064c4bf2e2437df00d40c994086bbc816b8d568148d9526a25c22ce2fe5055b727504580b4b3ecf336dbd6a22847638ca66ba1052083e8817
SSDEEP 192:uu7PsNlmQRVV6bi8oQmiU1MLQy7Ea+jROmDRk9amnqblRk35zk:njsNlmSVVX1uQYEa+NOj/qRk32
TLSH
T15B4219317839AC3259EBA244F48A37539FF850B799865F94D6DE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7bba8754fa95d59d526e52ee06f8afb6b68be8c00a1b4afaec774156d396b198
MD5 184882e1216a3995521c870c9be5e152
SHA1 83c9bd367bcf75e488efc5fe0f0054b2aba8178f
SHA512 2e6ebc4c625d92b6843ce368cc6ebf7921260e3ec4c305207424434187b086c442ae8bc6fe625afc27a1db70551dcc85a93ed6105335a85aaef9d24cc0e21523
SSDEEP 192:uu7osNlmQRVV6bi8oQmiU1lLQ1EEa+jROmDRk9amnqblRk35zk:nMsNlmSVVX1nQKEa+NOj/qRk32
TLSH
T15E4219317839AC3259EBA244F48A37539FF850B799865F94D6DA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a67399bc7de66acc757191355dc75ae54e50e5736bfb171de27615472d9987d3
MD5 315c475025f628f3f4f76d6b9f582c75
SHA1 20636d090db90a43e8a084ba3c41615edcf98042
SHA512 7912c0d497a7fb8aba1ec466b19bca76438ad1b42145c628292c68af0eb4a77936034644574ebb288f6f1c0e78cb465713e582c25e716969d76c48c770b16afb
SSDEEP 192:uu7VsNlLQRVV6bi8SQmiU1wLQWXEa+jROmDRk9amnqblRk35zk:n5sNlLSVVXDiQYEa+NOj/qRk32
TLSH
T1554229317839AC3259FBA644F48637539FF850BB99865F94D6CA9F1D00C729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9dc5457403d70626d3485c7d3389dd4dc03e8d2e85011510181e3f9d317b4d05
MD5 5454f4e5422bb5e94f2f1c9d9fd24223
SHA1 1a8be3605e32f5678c43215ae48931c52892091b
SHA512 ceec9b24a2d3694cc1f274ab44f6423b0dc12dfc306ca7ae117e9519afad7d234eb06b631dfcd7d8688714698cacdf2186a5533ddbf52cca7f92beacc08f0bfa
SSDEEP 384:n5sNlLSVVXgkQKEa+NOj/qROOPrXLpe8C/h:5lFSaIOj/kOi9Ps
TLSH
T197725A30B57CAC625CFAA644F5963753AEF810BBD4896F94D6C98F0D01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 cdef9905a792b177aefc9518b71d5c1731678200f2c99d11fe883e3fcb3d8308
MD5 c7d9a5cb8b9fc504ffb3f7041939410c
SHA1 0894e488e4292e7d5e00fa4eba25827724758def
SHA512 5820cb9da5bd621aa5022b53cfc87992df05aa56b95823e28ede564bb9555568cee91488d2d4b6f8637aaca41f27bf4436ec2f376a364d6f1ed2e8913e50b17f
SSDEEP 384:nhsNlLSVVXgAQYEa+NOj/qROOPrXLpe8C/h:hlJIaIOj/kOi9Ps
TLSH
T1A6725A30B57CAC625CFAA644F5963757AEB810BBD4866F94D6C98F0C01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 12b2bb90d2007ae828ed704955f27b857100f773f480ac12e8bb5f4ff70faee0
MD5 f1635fdaf24a0e558dd9851cd7ced739
SHA1 72f760089da04a65a650d9edf221e848eb5972c5
SHA512 7a5a035b4a7888bc3f76c84e844c78d47cd62a44eff8da661db575647f84e1c5f44e6049d0a1dd4593f553a3e13a763fe2862940a1cc9741651562c81800b927
SSDEEP 384:nvsNlLSVVXtblQ+Ea+NOj/qROOPrXLpe8C/h:vl/maIOj/kOi9Ps
TLSH
T1F9725A30B57CAC625CFAA644F5963753AFB810BBD4866FD4D6C98F0D01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8297fb688c1fa6e3dc06bf12787ae7d84aa26732590696ef94c769a2755fc48a
MD5 9692a75a2adfb7f8221aa1466e37a34a
SHA1 d2a4d651d5134d926def1e4875f4c5cd49f6acaa
SHA512 65057dfcbe5673bac359972c56444271eff118e7d0a9d3310f89fc61ad2fbaf77fe1beac4068a8d5376dcd823f3ad3741839567435d5e1e9e3b8c53f42da584d
SSDEEP 384:nbsNleSVVXpRQaEa+NOj/qROOPrXLpe8C/h:bQvSaIOj/kOi9Ps
TLSH
T133725A30757CAC625CFAA644F5963797AEB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 40e2b7fe99f5592a7a2a7bde1b484890ec3add43074ebb4ece00662e050f304c
MD5 5a280f0572f0e848af592d481c7ed1d7
SHA1 bdfa51dbedb62d7a3a637c172f800906ccad53f5
SHA512 ee2a9124d40226ea16aacf2f9f3e76c12716d495b1c3f665e5ae1d388926b3309a0e82d7883746b4864cb8f163c1bcd443ca0b73e225dcdf6f864315d25beb48
SSDEEP 384:nRsNleSVVXVwQ4Ea+NOj/qROOPrXLpe8C/h:RQ6QaIOj/kOi9Ps
TLSH
T1DB725B30757CAC625CFAA644F5963797AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 9d441cea32aff54e3d58f30ee7b7b646846ce5c79adcfdc17280d838c987c2bf
MD5 df1232a8f8673f2eb791de97ff72572c
SHA1 3347a564ddbeb1d92c03b5139ba9a77eb3f43cbc
SHA512 46ffc3951508bb51909c9e5634bc46d451e8ad680d35f963f9f13268660de66d43d7c72ed07a7391518f109312d62ab84d0a133bd50b5aeeb7e1a1ed1ddfaa3b
SSDEEP 384:nRsNleSVVXVyQCEa+NOj/qROOPrXLpe8C/h:RQMuaIOj/kOi9Ps
TLSH
T1A7725B30757CAC625CFAA644F5963793AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8c58a5906bfc7abef0c821f2292fffea57bc422cf7e2f54f49f3f377260b2bfb
MD5 0b76f854deaf55e09dba5215a10e8e01
SHA1 012ed00920689ff6a88fc82f05373fdd92e904c8
SHA512 168b018768cf4b638a7f468b0a415770a830ed488351b8d1f3db8fd39ede7e4246d688f9061b612b8d34d9f18f4e971ddd92f6026001669a6ebfa7894cf291b7
SSDEEP 384:nesNleSVVXV3QVeEa+NOj/qROOPrXLpe8C/h:eQRYaIOj/kOi9Ps
TLSH
T198725B30757CAC625CFAA644F5963753AFB810BBD48A6FD4D6D98F0D01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 62d41264876b6d4e6abd6a32c8778c5b14844a56f86202c6202a655d6cf72365
MD5 b23aac640fbf2c0be6245d7b603b6d7b
SHA1 faf6471d03290af860760dbce435d0ee458c6db5
SHA512 29f50d217a273c7b647c75fcd27cbfbfd074320144633cc702929c745249e1ba35d05fdba9b26e20ad24f5c7ede6f3af35456c2022974235d88400a776a1b195
SSDEEP 192:jONI6Db0QmiUyoDrBa+jROmDRkFNznqblRU6:jONI6MvrBa+NOj7qRU6
TLSH
T121120735683C9C275DE6A548F4C737A79EA81077D98AAF94E6C94F0C00D778C230A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 19139df21e8c3efb388fad741afd2c7386159b7bc943e91e245c8b56b014aa04
MD5 b06dacfbbb8b7f7b61ef7a50c767c5d5
SHA1 f2371509847a2eae641b2f031a2153d54f1c3889
SHA512 e8e3110bcb8f8f76a6d8346d9a941801dbacecda7196f23e87c28c273bf68c4aaa9eff892b10e2b8647ba7bdef96f89f7a1cc9085aa0c54605588f69a4e724cc
SSDEEP 192:uu7PsNlmQRVV6bi84QmiU1RLQBIEa+jROmDRk9amnqblRk35zk:njsNlmSVVXZDQCEa+NOj/qRk32
TLSH
T1254219317839AC3259EBA244F48B37539FF850B799865F94D6DE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9874b91f2e4890a77fbb861df593362a9db739df9d1f8b6586724e6aef3617c8
MD5 b7e7d17804035af9ec9a758d87d8eba9
SHA1 b8173ce49120015534a2e56c760c9749fd6e39e4
SHA512 53ca8b74f158a501c710f8fc78165c2a9601dea352ddbd50cef7416f7b571a001533fe3233a1ee9b8dba61e764d8938d65f46565dd26ba096b89de840021ee65
SSDEEP 192:z7RsNlrQRVV6bi8DQmiU1JLQeqEa+jROmDRk9NmnqblRk35zk:z1sNlrSVVXw3QhEa+NOjGqRk32
TLSH
T188422A357839AC3258FBA644F48A37539FB850B7D8865F94D9C99F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 006f9a575a47885f975de4b0961fa895354b629b432bfa21bc4de19bf1bcaf74
MD5 d0649991454dbd633046e9b6324b7129
SHA1 13656094ca9e7100ef3f6aff6d6c90c7d48f5e5a
SHA512 259c7e75338b8f1bcc64a075c425f147c3c8dfc65feee45066dff378e7441c9b87d9a9104f1812744eae0d182e95bffbea36cfa01f3acf625ec4d5c5ac3c5eef
SSDEEP 192:uu7QsNlrQRVV6bi8zdQmiU1wLQExEa+jROmDRk9amnqblRk35zk:ncsNlrSVVXEbWQoEa+NOj/qRk32
TLSH
T15B42193178399C3658E7A244F49A37539FF850BBD8865F94D6CE9F1D00DB29C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 41317a9183346e3b5664eb4bc999b12b339eb8401710f9e394b810bbe55b79b0
MD5 e30d9ce2709c7dd850f2f2bb9e26fb38
SHA1 2ca2c99f627950ec06d9bb9e6a11583f3e901ab4
SHA512 9c2f53cfdf69d3bd171871c822b9e507bd8e8f4433fe663f24838fb420eb215147130d9aed4e81fdb409f43c3783cf78606556eb9980b4ca6ae3dff94a96dd94
SSDEEP 192:uu7AsNlrQRVV6bi8SQmiU1rLQX6Ea+jROmDRk9amnqblRk35zk:ncsNlrSVVXT5QKEa+NOj/qRk32
TLSH
T160422A7178399C3258E7A544F48A37539FF850BBD8865F94D6CA9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d99c50e487d9b78f88504770906d7ecf9a2e9149db98ea52438c3c3c0e3f8ef7
MD5 fb85806cde42480f3a71ee3e0fec6ff7
SHA1 b1c08cdfb936d28ee62f898e855141b66bfa1489
SHA512 6d8de9611bd131c5bf2eec0d166bd788dcef3de9abefcc28b0b79913e71725e97f8e8b62a74c054ba64fee39ca59913430f9b415ebbb2f396994de9d8b4ca24a
SSDEEP 192:uu7VWsNlmQRVV6bi8hQmiU1zLQFUEa+jROmDRk9amnqblRk35zk:nksNlmSVVX2dQ+Ea+NOj/qRk32
TLSH
T1244229317839AC3259FBA244F48A37539FF850B799865F94D6CE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee76717c42f979b50e3bda6bfab6602c1b1e181f9034bf3681d91d5cfbfb85e0
MD5 25af9972da64a20565e9c62732a1b163
SHA1 fbd1d454b648fc12031fd947965f1db16ac44339
SHA512 56441f4cb6cd4fb07d9adc6c428f817e987a33949d38877344be6cc01178adf84023928e1d8c600e2764dec2d6e87932b4c316d5888ca0c9665cda488936764e
SSDEEP 192:uu7hsNlmQRVV6bi8dQmiU13LQQlEa+jROmDRk9amnqblRk35zk:n9sNlmSVVXyVQEEa+NOj/qRk32
TLSH
T10B421A3178399C3259FBA244F48A37539FF850B799865F94D6DE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 836f9562d39a16b75d3e76355af984118a19727d6bacf72e1dcb63f59d8a417e
MD5 e84e6116c999c90cf28fda4f54b9d8d5
SHA1 2d26b0be40daebc23f589795152f774e18f9fb11
SHA512 566ad05f7e1d1b4d337fd6958beee0b87c874f418222df5511e9615f233ec87b2671da469a8f9d5f98eaac282b80c9a9f33cd9b038c32f8f61682df6e7f70e63
SSDEEP 384:nvsNlLSVVXuaQwEa+NOj/qROOPrXLpe8C/h:vlVkaIOj/kOi9Ps
TLSH
T108725A30B57CAC625CFAA644F5963753AFF810BBD4866F94D6D98F0D01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 3c54724a6f4107905690fd3153d770f993bf0eba5c45d1f84494073a7ef89848
MD5 2c7f4a286ab6e9eaf646e0e00ee1ceb7
SHA1 99aa6a66ee89cad5a7cfc34b91b508816b56d137
SHA512 ac2950bae51eeb4f619465b509341bf4654f873a3722a2a5e2d90a7ebce5320b4299e233e5003d75a90125da0aa4841ba3aa42af9a8c7e4bb9098a405c544065
SSDEEP 384:nDsNleSVVXpbQiEa+NOj/qROOPrXLpe8C/h:DQVmaIOj/kOi9Ps
TLSH
T12E725A30757CAC625CFAA644F5963797AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 25fdcfeee838a659fce998e41e09145f24b1989769d5867990a02af98bcb5ab7
MD5 7e3d3801fef077b5b81d68d7a6df5c00
SHA1 b13b64d07d448729c9aa19b6e562eba4f5d60398
SHA512 81ff1e7a4e717d90c558d97c63103e5390d958ab4345c1c7f2b5a981d7debf31b63fd4d5f4bbb98c838e772dfe7b730da2ee6d3d583fe4668af533f0835fc8e1
SSDEEP 384:nDsNleSVVXwGQ0Ea+NOj/qROOPrXLpe8C/h:DQ3oaIOj/kOi9Ps
TLSH
T1E9725B30757CAC625CFAA644F5963753AFB810BBD4856FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 d1efd5c7f453f6955b899a52fb4b598047ca251ade612da967b6c01c6dc5413f
MD5 09a611bddbc83df3fd60c950b75e0e46
SHA1 b37aae7cac176c4a4f0eb0a5ffe4f99bfe74f973
SHA512 7c2d6c734017c6325783ddf24fa2b9e86355c0e7ffbed2354101a0fb3b76f13bd9ccb6ba66cd97ee9c589e6a78d899831af128c8b26ed1f54f3a3851f0902130
SSDEEP 384:nesNleSVVXY4QaEa+NOj/qROOPrXLpe8C/h:eQlSaIOj/kOi9Ps
TLSH
T1F8725B30757CAC625CFAA644F5963757AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3f8d550726c8c35e794838b1a64f0d33b9fcf5ca82dcc3f82288562fa79b70fa
MD5 468b843f2671adc56233df98088e057c
SHA1 483651377da8bd31ecf9a82f63e5047e38ac7912
SHA512 7eb18bda6ddcd18b39c0dd57a90e082f9fe871e4810aa7600689b48281496025278425d2880e5c08462013f9798e582d2b7fb1f9549ac5c342b4876c5de316fa
SSDEEP 192:zBsNlVDbi8LQmiU1cLQWyEa+jROmDRk9NmnqblRU8:zBsNlV6I+QDEa+NOjGqRU8
TLSH
T1BC22093478389C375DE6A248F48B37A39EA81077D98A6F94D5C94F1C00D739C234B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b6cabeab1602eaf4b3e6a4c65ee1c08c8a4743b5705a72ee8a7cc8ae1808f1c
MD5 8646d114b658eeddd07c1c84bef57b90
SHA1 f35af671017df2bab420e62a8a1425f0089b5d7d
SHA512 e4d62d8da03a782e529d61e0f9130705beeb261008b6786b7a1ec3c7a8b8fbd066486bc8fab34abcb40d3f44ab60c0aa40cb86df6c838ba42591b0e1a5881625
SSDEEP 192:zasNlrQRVV6bi8QQmiU11LQl1Ea+jROmDRk9NmnqblRk35zk:zasNlrSVVX5fQTEa+NOjGqRk32
TLSH
T1FF422A3178399C3298FBA645F48B37539FB850B7D8869F94D9C99F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c24f985d3a3d5bac3d94fdfc296b62264694cb9146eb03e03b5ae1a666745ed3
MD5 0788fd72f1b7bbfb3476a44be65d896e
SHA1 6266773942461e7aaf48f8b5df39f138bf1d19ce
SHA512 5a9e726e539c8063ae34784b220fc097c81834c5750b00852714c384a20c97cc3fd9a1cbcf4c1c95248549fcf39459c656d49110dc1b23bf10437f05da21d047
SSDEEP 192:uu7FsNlmQRVV6bi8MQmiU1/LQMZEa+jROmDRk9amnqblRk35zk:n5sNlmSVVX1BQ4Ea+NOj/qRk32
TLSH
T13442293178399C3259FBA244F48A37539FF810BB99865F94D6DE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5e9cbe2a034b0b6135f4f180f82ac6a3689e39817d73298a6fe6fd4962eb70f6
MD5 9b1276b2675bd4806839bfdd36340683
SHA1 b388d927dc2ae47f6fbf11bb65704081b9809304
SHA512 bf69dfe54994232e410746a3e13557dbcf799c6de7ae0e14c5c2c878d13038c0f812914301faee90409e4c993ce6907670aeada36651fa4970ee6d2867f52b55
SSDEEP 192:uu7hsNlmQRVV6bi8GQmiU1KLQvSEa+jROmDRk9amnqblRk35zk:n9sNlmSVVXvwQaEa+NOj/qRk32
TLSH
T15042293178399C3259FBA244F48A37539FF810B799865F94D6DE9F1D00D729C230B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 89ec243eff537fc65d1372dc6992ae2022e5b34d9a79168838a52bb697f18295
MD5 4d06ea06ea530189a131a326e1f79eae
SHA1 dfbeab8384faeb2fd16c94962cc089f0a4066346
SHA512 949825b5d67568d5a7ec7cb522eaa5c59e655b431bcb40afbaab330326c95f86e634f8d80dd2d7bdd711350a2e5250c241b0748dfa83c9f06dbc5fde66a653a2
SSDEEP 384:nvsNleSVVXucQwEa+NOj/qROOPrXLpe8C/h:vQb4aIOj/kOi9Ps
TLSH
T1A1725A30757CAC625CFAA644F5963753AFB810BBD48A6F94D6D98F0D01C729C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2ed93590b581cc6dbd220d65098ce21aab94e7c58242803d5ab18d6040d2ad2
MD5 03b5114302cb94d6b5f61a157ba541d3
SHA1 b065f435dc848fb6a678d478cf78a39181efbd1f
SHA512 ce9fa54af35e23ebc480a551a5847e5079440c9d33cd40f2349d3546ef4d216ce50fbaf915087be43e950b420f894214368af318da76c57f9c9b438b3bba95b0
SSDEEP 96:EqONkjQsjpf1bxX5ih/cIPURHl8h4otop5vnDdBfPgvE5BzatIRdy+88OmlmsR1h:vON76Db6QmiUyrDHBa+jROmDRuRgMSU6
TLSH
T12102E835697C6C7B9EA26E48F88737279FD4103BDA966B94D6D81F0C00D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 379dd4ccefc47141abbc1cda1d8f166ad249b93d19bab5dd7a5a16a0a425448c
MD5 23133c1f45e47ecb1defd77c1d920216
SHA1 d24f0abfc56ca9af1b269f0e3e8ed5ef24be8905
SHA512 f05c2ee24af30f1bdaaa0991d62663f86ef0ffb023651600270a0f5378967f02efbd0f318f74ac2bd39aa13f0e9ad7bbfbed31a192bcc2bf7b1dfd5d39c9395f
SSDEEP 192:zpsNlrQRVV6bi8QQmiU1/LQ3rEa+jROmDRk9NmnqblRk35zk:zpsNlrSVVX5FQbEa+NOjGqRk32
TLSH
T181422A3179399C3298F7A145F48A37539FB850B7D8869F94D9C99F1D00D729C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2c8160cf47444e92459d929802009b9e4de7d3b993b606a52b54709adbc7a164
MD5 4441a2e0ae13233d0c080aada11d9e38
SHA1 103a7b08e53aedd37e42842e3d0de8e79bc77912
SHA512 b0e0eda1e46e533d7bb504390aaba838e5531872d5b2b3387801b216db48f72a3c70c834440514e892c5e75e5b4fd64819e7ba24c439dfa513a01f2693f75782
SSDEEP 384:nQsNleSVVXuhQWEa+NOj/qROOPrXLpe8C/h:QQGuaIOj/kOi9Ps
TLSH
T1DF725B30757CAC625CFAA644F5963757AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 403f2aed7c3bc1197596f57ae51c54dccc2f305f3f1923818f4ff224ab8fa7a2
MD5 5e5b457d4ffc2ec0c8d2fae05e52bca5
SHA1 732beb2c782f92f2f30369eb5fd8c7857ee1ba5e
SHA512 a3c1aa860a968b4bd520209832e7682c92691f4c86c2687503c34bec795e4844b64f8a48e7a5454c54903e3c6b286cfecb2a4fb03782e0f62cd798a9bc8748f1
SSDEEP 384:nBsNleSVVXuoQqEa+NOj/qROOPrXLpe8C/h:BQjGaIOj/kOi9Ps
TLSH
T190725B30757CAC625CFAA644F5963753AFB810BBD4866FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 352fe5e3eb8c828b72fd43da380f2c3dd39aaef0dd9c29511010f27a6e3ffb70
MD5 8411ac66a4d73ff2884bf5e1339584ea
SHA1 2e0cdd0c3d63a39a5310e0b9190e9b99fa2760b2
SHA512 f55924f00c20c11979e74e2502e39487e75d163babe207f57c81bc419c14b6764a6c0a83968ca6aeba1777e3533c7f00b9bad29a8f239329d5dea8e7a00e4659
SSDEEP 384:nBsNleSVVXJnQYEa+NOj/qROOPrXLpe8C/h:BQ5oaIOj/kOi9Ps
TLSH
T112725B30757CAC625CFAA644F5963793AFB810BBD4896FD4D6D98F0D01C728C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 f2c344150ed57ccb2e5ff137d15eebd4ac090f802bfeb9da71d1fa2cb63f12bf
MD5 31b8249ce679c142bdd76a478ba2fda5
SHA1 d35f6ffb1edfcf595030cd42a87aa0b16552381b
SHA512 08ef7a9b1c590b344acadda7bec6569d01f6e2615cfc4b007224e742019ddde39f651725b2f5e5b6820e0d71701f6ee9b9a2b7c2a5ca96cfd6e8259b2943ad01
SSDEEP 192:zBONl6Dbi8LQmiU11LQBZEa+jROmDRkFNmnqblRU9:zBONl66I3QfEa+NOjeqRU9
TLSH
T12F22F73578789C675DE6A248F48737A39EA81077D88AAF94D6D94F1C00D738C234B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 81d78f8264bf783b8498f6d837a5215f8850317a58297c4535b7fde873433205
MD5 c000794a5ee3ecd40843569f154cf793
SHA1 48038d50176b3edf46a9984caf9b894b67cfe864
SHA512 45c5677f3024fb461f89c2a080f5d37b199c08fe17e6b37ae826c4ebf40aa8bb4da1c063720dc1cea805dc8b1d451e6918217c3c0f3369121ef1c90211ebbc48
SSDEEP 192:zBONl6Dbi8LQmiU1SLQP8UEa+jROmDRkFNmnqblRU9:zBONl66I4QPHEa+NOjeqRU9
TLSH
T1F322F73569789C675DE6A148F48737A39EA81077D88AAF94D6D94F1C00D738C234B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1ad70a41efb6373a951caa2fadfaea70288e434e630c7af1d3d984848b7f4970
MD5 6de8fc8339948f7c76f48ae7d3f7f4ed
SHA1 53700b90fb38551514e812369b33c489982bf2a5
SHA512 ab79e9d995c390256c8fb104aa3b9d172caf30cd883f4a6f749ba0ec75464cb1993e672fb9f9bf1915473af10164e982dbb072eb5b6fdf6e8b16c6be5ae21705
SSDEEP 192:zBONl6Dbi8LQmiU1/LQT/Ea+jROmDRkFNmnqblRU9:zBONl66I9QzEa+NOjeqRU9
TLSH
T14222F73578389C775DE6A148F48737A39EA81077D88AAF94D6D94F1C00D738C234B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c1c0cd0-47d8-45ed-bda1-64e2b0b497d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c1c0cd0-47d8-45ed-bda1-64e2b0b497d9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ab1bbb8d7fd2f992a12893565d8d5ed538a006465543bfa9a33d1c18797e91a
MD5 696db717f6503e10160e25e9249bd2bb
SHA1 11c41768d72dab8a49750f8dbb9ae71e31a49db7
SHA512 36159169a4a623af52e9fa00816302abd614e09f9c18464115843d1f0bc8777db96e93bb021ab85c8402a5701188d5289a99189d0bef027c3d3ec1ab90fae3d3
TLSH
T1FA41165CAAEA1148B3777F56ABF7A86D447BBC772E5A949D10000E4F0663B00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd4766e6-2fbd-4efc-9092-2010c8e9c1e8.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3532_1843366595\bd4766e6-2fbd-4efc-9092-2010c8e9c1e8.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8dg2mwm.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e34xwwov\v8dg2mwm.exe
Size 5.4MB
SHA256 859af0677a3f5be1b3ea61d9362e5438de8bac77b337391b1bff65ec40ae1235
MD5 1e2d6e843cc635d42d7e6e9a07126244
SHA1 573a3abb5a30aa168417de00a712c32ec8b3c1ca
SHA512 849b6774a22c7a99003b20a9ca8bd52ba0514433972d92a9253cc17190fdd20122807ea845ca948f39db83a5b2093a969e44fc2d8d08f25d8da5fcaa40d71c11
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6u8:AsTICteErownP0oTcMsABqljkV
TLSH
T1F3463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download