Overview

overview

10

Static

static

3

97b07b3239...02.exe

windows10-2004-x64

10

97b07b3239...02.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    65s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702.exe
  • Size 5.4MB
  • Sample260818-sd6rrswsds
  • SHA256 97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    anonymous
  • Password

    [email protected]

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 11 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 9 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Views/modifies file attributes 1 TTPs 8 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702.exe
    "C:\Users\Admin\AppData\Local\Temp\97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Admin\AppData\Local\Temp\97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702.exe
      "C:\Users\Admin\AppData\Local\Temp\97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5736
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe"
          4⤵
          • Views/modifies file attributes
          PID:2052
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:3444
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x318,0x7fffe1aac188,0x7fffe1aac194,0x7fffe1aac1a0
          4⤵
            PID:5012
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,17407986662930129440,8393448503558400092,262144 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
            4⤵
              PID:2644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,3776679351102865881,13706404415786338725,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
              4⤵
              • System Time Discovery
              PID:3332
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,3683109614785151680,3906618027312993586,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:13
              4⤵
                PID:1592
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,10896509746948188655,12626569942715128669,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
                4⤵
                  PID:2388
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,16544557036999502516,11389072945646679173,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
                  4⤵
                    PID:6140
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,4473217673226389880,4961813287965015949,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
                    4⤵
                      PID:1364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,8308454210515763093,13765711985519257633,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
                      4⤵
                        PID:2900
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,6589731247546682326,998387432350093178,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
                        4⤵
                          PID:3400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4788,i,12628378491891744284,4015335454622669699,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
                          4⤵
                            PID:6124
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5488,i,5272460070764150303,6351507628106877394,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:1
                            4⤵
                              PID:912
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,4252615138070577549,8519722173912709318,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
                              4⤵
                                PID:1484
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2159772995041639508,5354933045484607389,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                4⤵
                                  PID:2768
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5784,i,8365261052933921801,10542231957948842959,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
                                  4⤵
                                    PID:6132
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6280,i,2207716213022457305,6277154503681203623,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
                                    4⤵
                                      PID:4364
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,6281840179393899053,1667808555778214795,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
                                      4⤵
                                        PID:5692
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,6281840179393899053,1667808555778214795,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
                                        4⤵
                                          PID:5740
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12709467901071608006,10519008525095202894,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
                                          4⤵
                                            PID:5584
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6276654776759422262,4914798688730712013,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14
                                            4⤵
                                              PID:1076
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6988,i,18064825091194407104,1130137501201435752,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:1
                                              4⤵
                                                PID:4744
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7056,i,2551379748197690731,980434060366858900,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
                                                4⤵
                                                  PID:1172
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7076,i,4012789341320555085,9664826265592924713,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:1
                                                  4⤵
                                                    PID:1280
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7080,i,7816197750389159188,5135855707817021397,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
                                                    4⤵
                                                      PID:2812
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7108,i,3523902132354632822,18288750255514883206,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:1
                                                      4⤵
                                                        PID:5464
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7040,i,8823795322751041086,10476873913269057776,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:1
                                                        4⤵
                                                          PID:2008
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,14955957618897741921,14595548129437412041,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:14
                                                          4⤵
                                                            PID:4916
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,15915409971010297286,15984636909437015778,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                                                            4⤵
                                                              PID:2352
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7180,i,1011339649483373719,16831431450627723578,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:1
                                                              4⤵
                                                                PID:4900
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7316,i,13431627340127666648,8529816757111994275,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                                                4⤵
                                                                  PID:3576
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7340,i,4760482322955308081,860630434177077148,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
                                                                  4⤵
                                                                    PID:4616
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7456,i,4091478489355044178,12803360779290420503,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                                                                    4⤵
                                                                      PID:4496
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7564,i,8876190662357071173,11471700456476373021,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8092 /prefetch:1
                                                                      4⤵
                                                                        PID:3984
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7648,i,12472678549117490370,18187864878739820268,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
                                                                        4⤵
                                                                          PID:5696
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7532,i,140117186267087131,9232446351033892298,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
                                                                          4⤵
                                                                            PID:4548
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7612,i,1800144471785906841,16369645359952588322,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
                                                                            4⤵
                                                                              PID:4580
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7368,i,17966430977621964371,7453605034499430467,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
                                                                              4⤵
                                                                                PID:1480
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7548,i,7416208610166248419,10586247219493894798,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
                                                                                4⤵
                                                                                  PID:5360
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7484,i,10764679073720147418,13157899707415465380,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
                                                                                  4⤵
                                                                                    PID:1152
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7404,i,17630353365296647950,14782225365307262375,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:1
                                                                                    4⤵
                                                                                      PID:3508
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7400,i,16277678421951833900,7021213378512318457,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:1
                                                                                      4⤵
                                                                                        PID:5904
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7424,i,4805244887006361254,10437727549154974005,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:1
                                                                                        4⤵
                                                                                          PID:3700
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10608,i,10582383207726557369,13594111520055929561,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=10476 /prefetch:1
                                                                                          4⤵
                                                                                            PID:4032
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9776,i,13295750918482842059,1888691774932455075,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:12
                                                                                            4⤵
                                                                                              PID:6968
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11104,i,8613995281544528638,10325766328009535881,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:14
                                                                                              4⤵
                                                                                                PID:7144
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11180,i,15050355538933789189,1432118934503999970,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11168 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:6556
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5684,i,2451819033559396841,5148615040104283825,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11324 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:7128
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11340,i,330609352145151977,14304164086665615323,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11556 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:6440
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11724,i,7706722900077871214,13024768445823394704,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11424 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:6640
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11860,i,17769201213853250769,2077231891371874984,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11892 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:6720
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=11928,i,7018636748200900775,4861618441364423127,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=11964 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:6784
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12296,i,4990128076819243830,14452859997689983534,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=12292 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:6728
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=12492,i,14402282579600142580,6670837630699004187,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=12504 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:6680
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=4268,i,10323811617213758373,12806885040418000900,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:2524
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=12708,i,7414230513960296444,1264560138404742964,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=12728 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:7220
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=12876,i,14276091550112206741,13797375624350587990,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=12884 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:7312
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13044,i,18378853392404947380,2023192625696756714,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13056 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:7320
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13096,i,11921751605764479899,432836553478112461,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13100 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:7348
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13384,i,8114556788068206068,8380228182226712865,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13032 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:7456
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=13416,i,3376486394185596024,16665905230270965648,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13424 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:7560
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=13992,i,13727380768253791954,17924722894213840145,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13964 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:7980
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13836,i,4992409797436091214,16238488093587355058,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=13824 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:8100
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13552,i,3417506125187624805,8515564265062973143,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14028 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:8168
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=14220,i,4868155143287005528,17806511204251327413,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14232 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:1848
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=14356,i,4388376990190964523,14083567969156102118,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:7232
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=14280,i,3941606263751170260,12129682266422901039,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14528 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:7260
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14696,i,16354139754654274132,14092442319945090537,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14712 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:7384
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,8726244525339612249,1434283530175661686,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=1212 /prefetch:14
                                                                                                                                            4⤵
                                                                                                                                              PID:7860
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,4451834570003410291,14194976128150731565,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14872 /prefetch:14
                                                                                                                                              4⤵
                                                                                                                                                PID:7740
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,7777593035507244402,1385734364619123235,524288 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14920 /prefetch:14
                                                                                                                                                4⤵
                                                                                                                                                  PID:7768
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=14972,i,921627421293166447,10267583061899891895,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15084 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:7208
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=15300,i,348067337256682944,7990576559149498800,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15312 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:7328
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=15112,i,1961176530183813524,10856232726777047583,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15036 /prefetch:1
                                                                                                                                                      4⤵
                                                                                                                                                        PID:8772
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=6108,i,9010996205206428604,4301856036390330907,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=14924 /prefetch:1
                                                                                                                                                        4⤵
                                                                                                                                                          PID:8828
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=15576,i,5746458369334356698,16289119579648034466,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15604 /prefetch:1
                                                                                                                                                          4⤵
                                                                                                                                                            PID:8848
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=15744,i,4466334198079301954,12114527788334065059,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15740 /prefetch:1
                                                                                                                                                            4⤵
                                                                                                                                                              PID:8960
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=15804,i,8982475452204836053,16524403602035886229,2097152 --field-trial-handle=2316,i,973363974648021633,17487032060696558297,262144 --variations-seed-version --mojo-platform-channel-handle=15836 /prefetch:1
                                                                                                                                                              4⤵
                                                                                                                                                                PID:9140
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2816
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4744
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5004
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2920
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5516
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:888
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2416
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                            PID:1368
                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                              PID:4888
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1328
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5520
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4168
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2920
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2476
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3284
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3536
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\znxltl5e\8j1s4ask.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5952
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                            PID:5380
                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:468
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4268
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4496
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:3984
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3284
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1504
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bgzodvyp\mgaiz1s5.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2848
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:5464
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3508
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2032
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4888
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1448
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4036
                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:7016
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4e86ej8z\mv56y76j.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:7100
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                          PID:6676
                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:6884
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:7068
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:6420
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:6768
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:6888
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:6764
                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:6608
                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:6684
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6916
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdw5a5p7\ogzp07mp.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                            PID:4600
                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:7132
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:6908
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:7196
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:7260
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:7328
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:7400
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:7388
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lb80v9er\stzfvutk.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:7540
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                          PID:7712
                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                            PID:7820
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:7952
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:8036
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:8112
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:8180
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:7252
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:7432
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y73r2hja\u99yrujb.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                        PID:7936
                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                          PID:8036
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:8108
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:7284
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:8748
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:8820
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:8936
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:9184
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6opk7asy\nsnl9am0.exe
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:3596
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hef9ezy1\zou8j7zo.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                      PID:8556

                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                      • SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                      • SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                      • Size 6B
                                                                                                                                                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      f_00005b
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
                                                                                                                                                                                                                                                                                      • Size 280KB
                                                                                                                                                                                                                                                                                      • SHA256 fd5cd5d4564e179dfd88ffdc8f19a512715083250b9bd17ab65b12084dc8e82d
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      f_00005e
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
                                                                                                                                                                                                                                                                                      • Size 178KB
                                                                                                                                                                                                                                                                                      • SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      f_00005f
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
                                                                                                                                                                                                                                                                                      • Size 75KB
                                                                                                                                                                                                                                                                                      • SHA256 c0c67e2acf6587bb9c29499ea4d29203f10118c5c72ce282a186e4ff4d074688
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      f_000064
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                                                                                                                                                      • Size 205KB
                                                                                                                                                                                                                                                                                      • SHA256 4c9a35988e43dd60f97a1db4f53cdadb82d0e9cde6ace47d3405e08624ee25fd
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      f_000065
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
                                                                                                                                                                                                                                                                                      • Size 219KB
                                                                                                                                                                                                                                                                                      • SHA256 ca5b93497e6e274d2499b690f17a0bc33ed3738b1dc6ce71bcf89af24e61c8bd
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                      • SHA256 4fdf86e43bf719c9bac542dd7f476386d8bde8be3570265b32ea26dde5c41af9
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      the-real-index~RFe5a8bc6.TMP
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8bc6.TMP
                                                                                                                                                                                                                                                                                      • Size 2KB
                                                                                                                                                                                                                                                                                      • SHA256 61d4b3580ccf9f28d4e3981b43920cbc383867ad7a317f407e59b6b82cd6fabd
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Edge Profile.ico
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                      • Size 70KB
                                                                                                                                                                                                                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                      • SHA256 dec070a4273f8aa0686eb2fe49c22d97c86b85b82322286a599482a2e996f685
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                      • Size 12KB
                                                                                                                                                                                                                                                                                      • SHA256 2df412bf042839f9568c8a9934b5b55598f3a975a7708620896f15ffa5871379
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                      • Size 13KB
                                                                                                                                                                                                                                                                                      • SHA256 4b86897b8258951b263c46cc2c1974a522c701bc920bc3069049be8fb8e95f1b
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Secure Preferences
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                                                                                      • SHA256 093287a54bb2bb4eb0c90db101018a4c0f0397ab3a66b5052990c4c5b0b79382
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                      • SHA256 c8b9f0881f024e9a5129999c3027c6f8dbb0c44b0ee2d3b65e5113d8c978759a
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                      • SHA256 775c4482f000cc60843786c99ae0cd52fa47b8c68ff172b91eee92b114ae0187
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 1f554a8e329bf3fe46df18da396b84b176f76457a0f8d34233caf85100ac0c8d
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                      • SHA256 57429ed95e7358372ce3c413c212055f114f529f65ece29d46c373cc8b5dbc62
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 39KB
                                                                                                                                                                                                                                                                                      • SHA256 698169e857bde8848d5a604d7ca4a3ea3581ca457ecd7b85e60f0a05b45cf10c
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 ab7d99bab57b14a8ee3aa456438674727159800443c30b8fc9c728a49da375c7
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 a56a5c4a0656e9f782eb343faa66540cef1eee58f0021830a286ae7738f23a19
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 087fb8e0c343398af59ae3ec9f367ee67d553d22a5598af1102621545d4dd636
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 38KB
                                                                                                                                                                                                                                                                                      • SHA256 83cc11f0de3d54c05623e14bb75805c5547332f6bfbc1e440bdaa5e37f5e228b
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 765ecd5bd446d51b4b3cf565444c62bfe5299777e7b413b774e1284b38d236d3
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 35KB
                                                                                                                                                                                                                                                                                      • SHA256 976b5dcb47c5b3f1c5abffc58ad73d7872c4f25a7da25efd72018b4da6dc7b12
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                      • Size 39KB
                                                                                                                                                                                                                                                                                      • SHA256 cfe92dec4f32cec6dac1dea4d548078d6c57bafca41b72dda917f9a7d856609d
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                                                                                      • SHA256 1533d3e3def28c35465e06f3e882fdf2e6c47d819568722ff6cad65b0de13a22
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      RevisitationBloomfilter~RFe5a5507.TMP
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a5507.TMP
                                                                                                                                                                                                                                                                                      • Size 392B
                                                                                                                                                                                                                                                                                      • SHA256 55995c4d238f32a69977910657a6e95c72dc72fd1c14a2df35895a24ec6b1647
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      6c57f69c-6df2-4120-b078-f6a91b9ddda4.tmp
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c57f69c-6df2-4120-b078-f6a91b9ddda4.tmp
                                                                                                                                                                                                                                                                                      • Size 13B
                                                                                                                                                                                                                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                      • Size 154KB
                                                                                                                                                                                                                                                                                      • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      metadata.json~RFe5a1c72.TMP
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a1c72.TMP
                                                                                                                                                                                                                                                                                      • Size 132B
                                                                                                                                                                                                                                                                                      • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      2b0470cb-f0d0-46b4-b04c-ee27c7c9b64d.tmp
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2b0470cb-f0d0-46b4-b04c-ee27c7c9b64d.tmp
                                                                                                                                                                                                                                                                                      • Size 1B
                                                                                                                                                                                                                                                                                      • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                      • Size 94KB
                                                                                                                                                                                                                                                                                      • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _bz2.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_bz2.pyd
                                                                                                                                                                                                                                                                                      • Size 84KB
                                                                                                                                                                                                                                                                                      • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _decimal.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_decimal.pyd
                                                                                                                                                                                                                                                                                      • Size 265KB
                                                                                                                                                                                                                                                                                      • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _hashlib.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_hashlib.pyd
                                                                                                                                                                                                                                                                                      • Size 64KB
                                                                                                                                                                                                                                                                                      • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _lzma.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_lzma.pyd
                                                                                                                                                                                                                                                                                      • Size 159KB
                                                                                                                                                                                                                                                                                      • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _socket.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_socket.pyd
                                                                                                                                                                                                                                                                                      • Size 78KB
                                                                                                                                                                                                                                                                                      • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _ssl.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_ssl.pyd
                                                                                                                                                                                                                                                                                      • Size 151KB
                                                                                                                                                                                                                                                                                      • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      _uuid.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\_uuid.pyd
                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                      • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      base_library.zip
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\base_library.zip
                                                                                                                                                                                                                                                                                      • Size 711KB
                                                                                                                                                                                                                                                                                      • SHA256 6b853f31baf3750be8d368a99caf893be25df4efa0e218f9219b38d553487b3c
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                      • Size 3.3MB
                                                                                                                                                                                                                                                                                      • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      libssl-1_1.dll
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\libssl-1_1.dll
                                                                                                                                                                                                                                                                                      • Size 678KB
                                                                                                                                                                                                                                                                                      • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      python39.dll
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\python39.dll
                                                                                                                                                                                                                                                                                      • Size 4.3MB
                                                                                                                                                                                                                                                                                      • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      select.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\select.pyd
                                                                                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                                                                                      • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      unicodedata.pyd
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI29842\unicodedata.pyd
                                                                                                                                                                                                                                                                                      • Size 1.1MB
                                                                                                                                                                                                                                                                                      • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      content_new.js
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_1060112070\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                                                                                      • Size 10KB
                                                                                                                                                                                                                                                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      messages.json
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_1713127428\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                                                                                                                                                                      • Size 851B
                                                                                                                                                                                                                                                                                      • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      cn11fr7a.exe
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aydvda83\cn11fr7a.exe
                                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                                      • SHA256 97b07b32391c691c6dc7a4127be0f655f1ed66c9afc6afc62c8337c0abc99702
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download