3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2

Analysis

max time kernel
6s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
Size 5.4MB
Sample260821-1mtskade38
SHA256 3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2
MD5 3afe7058403650f98d66ad06c21ec7e0
SHA1 bca1fa05996e42fd86832abcf220ad5e3834639b
SHA512 4e896d023ef93966419752ebd88b13f83fb5497541854b135ea0b55d1ad4f944b96e87bf6f4fefbf70074bf96a98fa70d4251f848b6901789b99146eb82ca025
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRE:OrICteErownP0oTcMsABqlaOz6
TLSH
T13E463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9823
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4315
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9065
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3244
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4346
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2266
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6650
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1299
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2173
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6918
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3387
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8625
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6181
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8837
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6978
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2935
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7183
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3768
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6224
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1565
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6463
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4871
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2159
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5393
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8113
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9688
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4473
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8687
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4738
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2149
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6340
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8675
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9477
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1928
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5790
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8507
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2581
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4941
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4020
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5747
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6051
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2554
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7841
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7664
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8809
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7094
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1290
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7283
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3226
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7803
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8647
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7137
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7991
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7237
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1429
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7424
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7348
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4787
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6232
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3031
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2060
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4247
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8964
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2406
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6033
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4836
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3948
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3763
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5739
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9675
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6606
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9496
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2999
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1400
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2091
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3010
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3266
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9597
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3766
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4609
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4922
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9590
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8203
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7540
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1837
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7385
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2799
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2388
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8550
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2545
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3665
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8645
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2063
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1087
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5107
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8874
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8789
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5614
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4237
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6507
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3290
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6323
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1110
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8335
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7794
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9898
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5548
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2786
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1052
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6334
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7930
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2597
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6256
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8559
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6731
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9240
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6184
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5021
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7099
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6582
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1980
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5638
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4041
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2055
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4449
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6358
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4086
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9350
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8336
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8962
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9774
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9142
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9183
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4443
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3017
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7021
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3939
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1125
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2044
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5276
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6067
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2680
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7960
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9661
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4847
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3790
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5497
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3610
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4643
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9788
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1181
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5495
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1854
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8576
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1920
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4422
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8030
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7821
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7940
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5950
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4895
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5350
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1367
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7748
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8956
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8920
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2850
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9728
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1112
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1247
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4102
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6452
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3821
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8966
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2138
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3897
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5934
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4953
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3167
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7807
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4322
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6684
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3564
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4048
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2614
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6699
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8179
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1127
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1343
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1321
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6907
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7796
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6441
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8930
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1462
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5798
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3449
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7285
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3691
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4549
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9853
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2456
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1040
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6416
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1240
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4463
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7576
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1585
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8445
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4952
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6204
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4206
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7526
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8548
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4679
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3055
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8477
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6579
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8194
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6557
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3926
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4166
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3480
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5578
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6038
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5598
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4916
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7096
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7220
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5877
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8861
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8599
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8355
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6673
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4686
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2328
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4982
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9553
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5082
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9917
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cwokf4.exe	ehnqqd5a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cwokf4.exe	ehnqqd5a.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x52occ.exe	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x52occ.exe	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe

Executes dropped EXE 2 IoCs

pid	Process
1268	ehnqqd5a.exe
4752	ehnqqd5a.exe

Loads dropped DLL 24 IoCs

pid	Process
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
4752	ehnqqd5a.exe
2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
4752	ehnqqd5a.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\xsvjh7zo\\ehnqqd5a.exe"	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\6zsbgct6\\92wp07gm.exe"	ehnqqd5a.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
780	ifconfig.me
4032	ifconfig.me
111	ifconfig.me
254	ifconfig.me
308	ifconfig.me
536	ifconfig.me
5253	ifconfig.me
661	ifconfig.me
5318	ifconfig.me
791	ifconfig.me
2180	ifconfig.me
2820	ifconfig.me
4602	ifconfig.me
986	ifconfig.me
4848	ifconfig.me
2261	ifconfig.me
263	ifconfig.me
452	ifconfig.me
4532	ifconfig.me
655	ifconfig.me
162	ifconfig.me
249	ifconfig.me
261	ifconfig.me
622	ifconfig.me
852	ifconfig.me
944	ifconfig.me
515	ifconfig.me
927	ifconfig.me
1026	ifconfig.me
1034	ifconfig.me
1624	ifconfig.me
3727	ifconfig.me
224	ifconfig.me
18	ifconfig.me
623	ifconfig.me
236	ifconfig.me
591	ifconfig.me
1698	ifconfig.me
2731	ifconfig.me
618	ifconfig.me
1108	ifconfig.me
2812	ifconfig.me
268	ifconfig.me
431	ifconfig.me
1337	ifconfig.me
4480	ifconfig.me
358	ifconfig.me
481	ifconfig.me
704	ifconfig.me
1340	ifconfig.me
1461	ifconfig.me
3999	ifconfig.me
8	ifconfig.me
563	ifconfig.me
680	ifconfig.me
3446	ifconfig.me
713	ifconfig.me
6	ifconfig.me
473	ifconfig.me
4993	ifconfig.me
170	ifconfig.me
783	ifconfig.me
2981	ifconfig.me
3838	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 19 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3160	cmd.exe
4504	cmd.exe
7980	cmd.exe
7652	cmd.exe
7928	cmd.exe
8796	cmd.exe
1728	cmd.exe
5324	cmd.exe
7380	cmd.exe
8448	cmd.exe
5432	cmd.exe
7868	cmd.exe
10104	cmd.exe
4948	cmd.exe
5564	cmd.exe
8172	cmd.exe
5228	cmd.exe
8244	cmd.exe
11240	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2972	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3564	msedge.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2796	1296	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	85
PID 2796 wrote to memory of 4948	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	86
PID 4948 wrote to memory of 3512	4948	cmd.exe	88
PID 1268 wrote to memory of 4752	1268	ehnqqd5a.exe	91
PID 2796 wrote to memory of 3564	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	92
PID 3564 wrote to memory of 4620	3564	msedge.exe	93
PID 2796 wrote to memory of 4904	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	94
PID 2796 wrote to memory of 4468	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	95
PID 4752 wrote to memory of 3160	4752	ehnqqd5a.exe	96
PID 2796 wrote to memory of 1640	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	98
PID 3160 wrote to memory of 2768	3160	cmd.exe	99
PID 2796 wrote to memory of 3616	2796	3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe	100
PID 4752 wrote to memory of 1644	4752	ehnqqd5a.exe	199
PID 4752 wrote to memory of 3052	4752	ehnqqd5a.exe	102
PID 4752 wrote to memory of 3892	4752	ehnqqd5a.exe	103
PID 4752 wrote to memory of 2108	4752	ehnqqd5a.exe	104
PID 4752 wrote to memory of 208	4752	ehnqqd5a.exe	134
PID 3564 wrote to memory of 2972	3564	msedge.exe	108
PID 3564 wrote to memory of 4288	3564	msedge.exe	109
PID 3564 wrote to memory of 3916	3564	msedge.exe	110
PID 3564 wrote to memory of 4288	3564	msedge.exe	109
PID 3564 wrote to memory of 4288	3564	msedge.exe	109
PID 3564 wrote to memory of 3916	3564	msedge.exe	110

Views/modifies file attributes 1 TTPs 18 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7988	attrib.exe
7920	attrib.exe
3512	attrib.exe
2768	attrib.exe
3740	attrib.exe
4976	attrib.exe
7200	attrib.exe
8864	attrib.exe
8512	attrib.exe
8616	attrib.exe
8104	attrib.exe
8232	attrib.exe
5724	attrib.exe
7504	attrib.exe
8108	attrib.exe
9852	attrib.exe
5376	attrib.exe
5436	attrib.exe

C:\Users\Admin\AppData\Local\Temp\3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
"C:\Users\Admin\AppData\Local\Temp\3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe
  "C:\Users\Admin\AppData\Local\Temp\3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe"
      4⤵
      Views/modifies file attributes
      PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffe4c75c188,0x7ffe4c75c194,0x7ffe4c75c1a0
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13228155579046281359,13444562143658131955,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:3
      4⤵
      System Time Discovery
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,14555900854275184776,16152187734766101711,262144 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,3780578867516894663,1170603391523920264,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,699807505821860748,2696068255760918643,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,8879081179468332842,14498418335704116159,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5622147658320467507,17721453952430383532,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,1998680246348292405,3579369298455579034,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4612,i,11213237547422077442,16348036566335013998,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4904,i,12777410771747308101,10249902518109315159,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5040,i,4665926716476011981,4290912068279000874,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5204,i,15189936455916663146,1914691030868231775,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5188,i,649552471493076143,8482371710796316231,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5536,i,18288964890043642543,13061295975245781867,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5660,i,16411929363143914159,5866504949613459264,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5796,i,1511250996306609796,10662364841561256835,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5944,i,8578364699639751575,4534654318555439802,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,6557944857005560239,13747137085620680358,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6664,i,8370492257172824544,1219556197586123792,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6888,i,9569879927758296089,12834305374479707057,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7060,i,15796387390261194927,10164662165217103767,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,7118890588913403425,714059973551199232,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7248,i,17400316013003829299,8730099228148594525,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7408,i,10812513582816674409,11024176445746857285,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7452,i,3137134505137408035,11120213952597827544,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,16125472969519938083,9990604131910957946,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,14705878117098864951,10075112417927346281,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,10476268793912548274,10541399996085494264,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:8
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4600,i,6961359052661824451,10054157962567931625,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7860,i,3911958249386889346,5227582394784678818,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7896,i,13401480770766599708,17176694121073515680,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7824,i,7019028457690827825,16745831304885397426,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=8992 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7964,i,2582816664901375157,1618218769921457883,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9076 /prefetch:1
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3412,i,1380635052392455393,15068130919634760856,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8056,i,9627763340671502915,1278541194780456773,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7908,i,11951867924252632772,1669910481010808394,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8100,i,10783780539169512689,10017696078564852577,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8292,i,2987701071913408702,3878453818427749584,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8236,i,11183295133484065016,5074217390043098195,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8308,i,8911644306412256640,14917951272722249954,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:1
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8312,i,7003730397416388205,10029274794208759765,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9272 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8364,i,18373202257531839334,7401356602130391067,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:1
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8384,i,6818873766844777490,16771632404268016259,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9328 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7268,i,4271447674014793694,16366935842488734122,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=6812,i,13602717193661124580,9055701812640929726,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9384 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7368,i,2217297005862929208,5594766518087231292,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6536,i,15727703157149603389,2341008939264234045,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7424,i,5531181974298179838,9764820524612403368,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8416,i,1542760560326937952,13096055037283322437,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8552,i,16180858707569713863,12392231270295489791,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9744 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8772,i,16941087921965690099,9776777874271107954,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:1
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8584,i,2176589097736832401,14088549398112278141,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9820 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8728,i,13127241521976209793,15217085786594261788,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8724,i,15974223910582551116,8491204883684606062,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9800 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8680,i,6473792712923605428,17559140470786265326,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8656,i,17187991012938447032,4132018967384761882,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
      4⤵
      PID:6148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8620,i,12683595156560156793,3661725931635273160,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8812,i,12375260803238169879,424732440021685006,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8612,i,10749426674183891139,8725520192112381180,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9788 /prefetch:1
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8508,i,1093458288080804044,2797852681389636600,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9568 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7376,i,11553723852044274171,1552769255095298701,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8432,i,17426848683486800424,3544281220772442226,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=9660 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13548,i,5907597878889168987,2481779317486479160,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=13732 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7244,i,849008794640798824,10983959366251068591,2097152 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
      4⤵
      PID:7096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11520,i,12408243973666990971,14696041051283773294,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=14540 /prefetch:8
      4⤵
      PID:7668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11520,i,12408243973666990971,14696041051283773294,524288 --field-trial-handle=2732,i,2399798294973173854,10573175024416979351,262144 --variations-seed-version --mojo-platform-channel-handle=14540 /prefetch:8
      4⤵
      PID:7684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3616

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe"
      4⤵
      Views/modifies file attributes
      PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4744

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe
1⤵
PID:1400
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zsbgct6\92wp07gm.exe
  2⤵
  PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1728
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe"
      4⤵
      Views/modifies file attributes
      PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2056

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe
1⤵
PID:2728
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9etyw220\erj4naii.exe
  2⤵
  PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe"
      4⤵
      Views/modifies file attributes
      PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5736

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe
1⤵
PID:4240
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iub2z6lw\n8bi0qu1.exe
  2⤵
  PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5432
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe"
      4⤵
      Views/modifies file attributes
      PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5640

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe
1⤵
PID:5968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j1nknowk\21zj4vs3.exe
  2⤵
  PID:6076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe"
      4⤵
      Views/modifies file attributes
      PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe
1⤵
PID:5364
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\obxqvw2z\pjo2kokp.exe
  2⤵
  PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5564
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe"
      4⤵
      Views/modifies file attributes
      PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7208

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe
1⤵
PID:3056
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44oo96yb\d3e25u2b.exe
  2⤵
  PID:7256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7380
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe"
      4⤵
      Views/modifies file attributes
      PID:7504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7952

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe
1⤵
PID:8072
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v2cv4vns\nmskpaad.exe
  2⤵
  PID:8144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8172
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe"
      4⤵
      Views/modifies file attributes
      PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7668

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe
1⤵
PID:7880
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bawy5lg8\oap5wqw2.exe
  2⤵
  PID:7956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe"
      4⤵
      Views/modifies file attributes
      PID:8108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe
1⤵
PID:7472
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kglcd12e\l9fvkrw5.exe
  2⤵
  PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7652
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe"
      4⤵
      Views/modifies file attributes
      PID:8104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7656

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe
1⤵
PID:7508
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p8ruxs3k\zj5z73nq.exe
  2⤵
  PID:7600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe"
      4⤵
      Views/modifies file attributes
      PID:7920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7996

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe
1⤵
PID:7908
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt3z802i\0dfzvdkr.exe
  2⤵
  PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7868
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe"
      4⤵
      Views/modifies file attributes
      PID:7988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7852

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe
1⤵
PID:3948
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e8ykxck8\w4tjo9mx.exe
  2⤵
  PID:7984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7928
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe"
      4⤵
      Views/modifies file attributes
      PID:8232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8616

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe
1⤵
PID:8608
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yqkx1rd1\ihivvysv.exe
  2⤵
  PID:8748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8796
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe"
      4⤵
      Views/modifies file attributes
      PID:8864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8380

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe
1⤵
PID:9088
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\on2dn3nf\yqecf0xl.exe
  2⤵
  PID:9164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8244
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe"
      4⤵
      Views/modifies file attributes
      PID:8512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9000

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe
1⤵
PID:9004
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\twtp5380\3vs94xlz.exe
  2⤵
  PID:8236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe"
      4⤵
      Views/modifies file attributes
      PID:8616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:544

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe
1⤵
PID:9816
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ypk2r1wm\owkaoa2x.exe
  2⤵
  PID:9964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10104
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe"
      4⤵
      Views/modifies file attributes
      PID:9852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10248

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe
1⤵
PID:10980
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\71ofvf3o\cy7tykxq.exe
  2⤵
  PID:11124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k4cmehgg\e8tg4fmm.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4889a45b-cc3a-4ef5-b55a-2d998d567b4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4889a45b-cc3a-4ef5-b55a-2d998d567b4b.tmp
Size 18KB
SHA256 c5a3cad877620e40c1fc388193cfd7897ae3a959ae02b557ad7b98a65d61ca1e
MD5 19945f3713a82106b35011f608347f2b
SHA1 009612f193ac93f14dbc6cb4ab34ccafe6f4c5b3
SHA512 d9281f00fe435a4ac986fc70bfc2f4cebcbf2aec2710c90d3e07d7d3c324d0ab3e24e99a76f4da86146dead41d484cdf420c0354a897d559154003ac22bf346a
SSDEEP 384:nY/ZcIJsNCUBZJjrAVElkWOpdF7ivC3Sooy:IJSfP7mF7i6iox
TLSH
T130828D705C7DAC7628EBE245F5863A675FB850B7DAC95F40E4E9C72C00C62982B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4af7bdd8-b7f6-4996-a529-cf0789aaf85e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4af7bdd8-b7f6-4996-a529-cf0789aaf85e.tmp
Size 9KB
SHA256 7d385038bbcf64d624065233de3049facd22fda613227c534e6a750011db27db
MD5 35820b6e91785bd0a047543d941673bd
SHA1 e2ee387abad3337ccb378bd526c0449c99d61264
SHA512 3f240b35472f47ea0bdc814b4578bfbfb0bae8ac4510c829c85c2400557b59bd9c593bfc0ebeb3cb9130af210d3134dca1918fdbb578ae7d688abd2914770c95
SSDEEP 192:zDMQONC6kmHnQmiU1VOFgk03/irbN+cItqpOm2U9:zQQONC6ZpS2kWOpOF7U9
TLSH
T1A622087468A9AC7B9CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74e62c8c-d592-4c6f-8009-6ab80764b072.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74e62c8c-d592-4c6f-8009-6ab80764b072.tmp
Size 12KB
SHA256 35bb676e4d1ddfe3e82ebd86aa2e2fa9da439c16d315310fadf724664c835df6
MD5 ad3613aa524786dacba2e03b8e62f40c
SHA1 a5b6ee8b1d894a5128df37f0f9416c07b0933088
SHA512 93bef60def40a501249829920ba2706a00222d9971995dfd9deb56a1a8f9c4e2570cc97f3a34db45c0c56b8e6390c7f0ddeef96e7ea4a392775d85bbeaf58083
SSDEEP 192:zDMCpsNCOQCDJnJjrHBmH6QmiU1LO3Uk03/irbNycItqpOm29YyXj/knt:zQGsNCOBZJjrAWkEkWOpqF75ont
TLSH
T1E7423B746879AC365CEBA605F44B37639FB810F7D9C42F54E9D58B1C00C729C2B1A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 282KB
SHA256 14abb85ffc31753aabc62a11e9660dcb3deaf36db14914b66ef159d7be19777b
MD5 4d0e2606b27e72406112dff5977b4404
SHA1 8d222723724699e7c7a5f90aadc87908ebbc0cb4
SHA512 db2f3fc13b2bbbec04e7618b819bb53e27c279d2c6b521dd03546ba1954859c9468264a97947e5d03137fa198e6385061c7507cc385fd0339582f36c30381b37
SSDEEP 6144:jr+BnmgRCnQE4UxlLbtKuQS8x2KJ0LZRbCndC8OxjCnN:jx2CnQEhLb9Q7saARbCdCzZCN
TLSH
T1035423221BB343593663B7539F87A0AA55C2287D2FC36E05F9AC14F55BB20E4334B1B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 151KB
SHA256 53fe1f285c5dc21f7b82507e518d0d2586cecf30b6a8b69e9c73b9e6df248c6a
MD5 87f61144a9fbfad2d12dabd8d8f67318
SHA1 d9d70d37b4e26ce81f7793260d67980ab284f71c
SHA512 998e9b980dce3611a728c2cf46bd8f6241d84a2e8009cc9f1de274cb8f6ff002479fdc9d9f82222f7ec85291713938b48ef96b7b6d8a40398af5dd58fd0ac2b3
SSDEEP 3072:Z4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrAMrblUdKWt3LDK4abVcRa4Xw+u:Zg6JDk3ZgtDn2SMrxWKq3LlgWF6CM8Q
TLSH
T1C5E312238D6813DC26744EE14B143E2ED69DD934C7F301A886536EEC71EAA42F7C981D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 47KB
SHA256 53977bfb2ac015dea4764d0bc4e9083664e9f24891f9c980999f27c5f3aea8ae
MD5 1d983683a5ade8b330dfc9aca29a9369
SHA1 58f93d18f74734052664fe877382465e944678f0
SHA512 c95130abc0bcb06b8d3651eb7eafb76f0aa56928e6605754e27b3336166b4407877e41c20c3f2f3ba477c5d564fbd0392aa3c67dc953495bbf3eb08e30b5d613
SSDEEP 768:Fr8ZxwH4wUt9nRVyHgTUOjFnLVUNvSt8vPV7G+R8dbpPE69ScGW+Torv2u8:yxy69RVmYlBnqNDvPV7vR8XE69ScGRTH
TLSH
T1582301162C3977A25171BFC5D272024375EC888EB63ADD8F4C61EA442BE8CA361DC735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 89KB
SHA256 92f6a05c5b7528a164242171dea54f665ce00756266f1c193e455f743a40f8e9
MD5 58a009bfd37973849c93ffc38fe001b2
SHA1 69f6ecbd108b14fd7d5c6845c2b9e294a9b91e6d
SHA512 7f983e32d1c0073d482d00af493adea953efe84618ef7cdf5fb4e82a68d30dda48be48c938403d376a3105c5652f13166f0bffc1812b94975dd28af63f395010
SSDEEP 1536:PrBVOBa4OrL9/i159g0O4K6Ko7mvkUfVx6SiJLdSSdgBzeUoKz2ZopXSzIH:aA4OrR/iZi9hoqfVxEJMdFQHIH
TLSH
T1DC93123FE457303C1B8096276C468613988BFB720246477EFD3C56626668C92F76E52E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 219KB
SHA256 84a24464992c164ec960071a89bbd0d67704bbb0b8b97cc0abc1bbd242598f73
MD5 72e86e7a0c797e8c42c2993d99717813
SHA1 701f65a51a995d9f890385ac29e2e669134d5e65
SHA512 4e11017fbf8396e5646731e06af7c6d56e0712156da828ea299b6f5bd69db056f4f7ba9d6b7e82d54397fa150e01c42f1a8de04be4f8fa261374d754375e2a7c
SSDEEP 3072:3bz9barNmHnBtA4Xb7fgyWuF08Pz3gywjM5Uait7AlOhUIK96YWyDRfFpS:rzsBk1bgoxbgywjM5FuAgqIE6PyDRfFw
TLSH
T1652423E04A0807FFC17407B74DD27DA9B73D8AA88DDB1BB18BCED687A52E3052419253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 214KB
SHA256 aee16d0ea306148a83c17886cad0422915a4453947483162d5faaf4020ac6aa2
MD5 f03377d604c5591c3a560a73108e9564
SHA1 a01a0771663f21d8652d00b99d0181c9dc6da885
SHA512 a9316f13eb0a20235e54a198d04ea3539803d0111b7ece68cf2c2c5a635c2c00d2899390ac9d40a210334647d6a50c17660668f651346f5f98c0a7102c7564c0
SSDEEP 6144:oSobZtyoq8Jd1ImfyY4ahX8T1s6eg2PRlM19xfehL:lgJd+mfX4cy17wwvxq
TLSH
T1C724234D68477D53FE417CE10DEAF402926AEB66234F97D5A613817D833703BA4BAE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
Size 26KB
SHA256 a983e0f95af54b58e1a15e228c06799be82f0fae9debf3afe8d5f2d1d82fda08
MD5 f2a2b3c1bb190cfe7c0e6dd0e9b51d71
SHA1 c24b7cd9218e600c890c30aab9cd5f19c14efd57
SHA512 e3d26c4e041eff323c6ac2673a81512cbe5e066cf5e43d90125a33ea7ab73c2d647c9abce44b0f859b1ed25ae3d654ed552cda0b2cf76dc55616aa05feaf7463
SSDEEP 768:QBN21TdIzYV1EG27V8ASjtyq1TcA25YBT:ngYV1J2ZWyq1J0YBT
TLSH
T1C4C2E177EE69034D8AE43C2A4E0D51784CF57B9F2C16FC806B15B81496E0EA729FBB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e097db6b0ea7651b0085ef1cce62def2d5d71946d40aabbb2cda97596b2e932f
MD5 cec631093fea5ad011f6f6bf6ba28db7
SHA1 c9152eba4270fbc1779ea73aeb0028eb7472b9ed
SHA512 9f63b26c1ae2ae6fed5b3a5f9c1ab0468e742894600f65ea5b8d1f7124137e4bb3105000ce0762fad805da3e31db5875ba388339ee32482c7f1dc8a9cec0caa5
SSDEEP 192:sxZGRXyM/jK1Ml8MjC/fqs/QPEdpLJkhFt/W6+WNiOudslfYBsLSFRIgyJ:sxZGh7C/fqs/QcSPbKCfsO
TLSH
T14552F912AA346A778DEBD219F951BB53D6F90473A2901D44AAFCCD1C04E6AEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4773ab91879697e5acdffa135189eb8aced93bbf141e57dabe70af889ca4f763
MD5 46a33fcffc98a32352e0d94f1c73d799
SHA1 48bc9ff786ab3ceb5a1d6612b6c4d3f2b11939a4
SHA512 7dfe8c01aac19eae989f45eb3f91ce8f450366270bd5b0f2ec1923fa151b9325428d8a004fbab5e6106b99cbcbf9b373bdfcef492dd292299915ac3a302706d9
SSDEEP 768:bf8iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeALl6opdUroeik9Unl:bf8iJANWvx76ru1jaJALocd/eLUl
TLSH
T111E20B3B680CCB7E4F844E9CEC2A6F966DD801CB5A948D5447FA884C03C76EE51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0fac132334beae3358b3eea78bb02c5fd63de6394bdbee0b14ff18a33d250e4c
MD5 4f8eb1d6d210b52080b4660b2dbe1741
SHA1 0e208c16f54967a41ca02c0b6b74d487f60adbe3
SHA512 39fa976410b40969dc7e9ebf3a8c00c0df1a6773cdc643f7409d6c0682a87ad3388663345e7118fc7191240f3951f341a122f3bcbdf2d1394252f32ca0c9ec72
SSDEEP 48:Kvp8j3pzTxuXesIZvxKM4kJxYBhLWvTSyZII9KwCOli+YkwkAk/PI/WkKKBCQkGZ:KUacKL6SqIKKwPTGK4kKGlSKA
TLSH
T1FB914205B1BA02433C7E380CA260A61756D671A33159B52B3FA905A20E67E355DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d06edff37135e2ff24d381b7a51a1ba93e0312c67f4226046201d0274af1c0ef
MD5 e48aeba8143c00895f11624e485a2aeb
SHA1 a3a7026af3f74e14aa7cb6c59e12d37a0a576336
SHA512 a655dddf3a2d9776ff73901d99e94919d11234552816748129e678269108c35e0e4a51edd3156bea79722576fd4e9b6537ccd2c5acfd415d16d3f597104b3993
SSDEEP 192:uuDMCSsNCDQCDJnJjrHBmHrQmiU1/OPRk03/irbNZLItqpOm29YyXj/knt:nQNsNCDBZJjrA98JkWOp+F75ont
TLSH
T126423B70A87DAC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f541c24d30bc2bd8a2087c23890df4e6df23b72ffed0372371c448b64e5ddafa
MD5 455e69396687eb67d74ef682e10b151a
SHA1 76196a4624f59ec90bab54bd1275576fdbea026a
SHA512 63bd7d31936141fc311fc64fd1229743dd19921b8b6bbb65be7a0ee76bc600b1bb249a1e31ba66e95fbd4f7047d8614f1b5ad377b0398822f05c47c85a6a8fdd
SSDEEP 192:uuDMC0sNCDQCDJnJjrHBmHmQmiU1XO/tk03/irbNZLItqpOm29YyXj/knt:nQLsNCDBZJjrAiA1kWOp+F75ont
TLSH
T168423A74A879AC365CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24628ceb349f127e7332d7f2efee189befe1a174060b1b96bef35953f52e469f
MD5 3e5117eeac03b5da44db4f8a20a61266
SHA1 907e4765364dcad6b4b938afd9861e623b19c79d
SHA512 2fc4bdd6d80d21ab6dc3da24e8e739ad1d1b6ae10b55cb2c4762da83ebbc8a871da0a8c49e4df18121b8749f773cdf0021bb4e52ab963a8c7135f2505ee55b5a
SSDEEP 96:ZqONk7QsjpfmUTmDK5ih/cIPURHl8h4otop5G5D4BhPwivh50xy0SFYKDAxvYebO:gONz6kDfQmiUygMZ903/i+QiS6aU6
TLSH
T12102F935687C6CBB8EA3AE45F48777275FE9117BEAD12F84D9E81A1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 94742f9ba6900f8370e03f658de17e7c8692f4f75bf49bf6fa0cfb5ec306099a
MD5 653a4a5260a015a116518dbe7075ae77
SHA1 a72a57ef813f39ed9262f26c83ceab0ca975fea8
SHA512 07003f80ce296aadae22d56a32ff5de8f6c0ad5fcda285b1e0babfcdc59afc188eb3e17fd720b0bdad648e278e12281ffed8e4b6389a1d1cc2d3f441d2b315d2
SSDEEP 192:zDMcsNCOQCDJnJjrHBmHRrQmiU1nOi1k03/irbNycItqpOm29YyXj/knt:zQcsNCOBZJjrAb0qkWOpqF75ont
TLSH
T185423B746879AC365CE7A606F44B37639FB810F7D9C42F54E9D98B1C00C729C2B1A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 818a6d2109bfdcbd4b017343ac320ffd79895e7722096dc916ac27fd8285be4b
MD5 08aa60371c4b1d8d8df0c2ccbcd09132
SHA1 41574550a33f011df22adb8eb173ea3d5572195e
SHA512 a97e361e9eadc9ac5f5b1de7c83ae93306ec64fde32b192d71c2c65d3cbd37ae6aa9a92329f6797fdeaf6cabff982fc2695fb753c06f15baa6b9119389195168
SSDEEP 192:zDMWsNCOQCDJnJjrHBmHBQmiU19OUrk03/irbNycItqpOm29YyXj/knt:zQWsNCOBZJjrA/iukWOpqF75ont
TLSH
T12C423B75A879AC365CE7A506F44B37639FB810F7D9C42F54E9D58B1C00C729C2B1A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d53906f3dae48b69ec7be98f008b0566f0f3c4ec8b19fc624c1c524eceafd0a8
MD5 d34b17c81f216a5d1c3e51b77e113613
SHA1 d3098626e7356e7548057a33cb342f4a6f1c0c08
SHA512 945cfb518f2b34447308948b2a00dd2acb23610bc349c66df48724eaf5aae64e00d5bd3ebe12723d940a59937ca5c9f0ef13d7160e0add48d5228d8fb6efcd88
SSDEEP 192:zDMC8sNCOQCDJnJjrHBmH6QmiU1ROl2k03/irbNycItqpOm29YyXj/knt:zQrsNCOBZJjrAWS8kWOpqF75ont
TLSH
T13A423B746879AC365CEBA505F44B37639FB810F7D9C42F54E9D58B1C00C729C2B1A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8d0f3dea00712683bc5e9d3bd8269ef92ec7ab970b6c811177b87b8a6925c718
MD5 5a20061a02b695c79dc9e8eb52830c75
SHA1 7223bbf442d7d0287e9540dc2ce6243baf82ff77
SHA512 b3bc2de93ab204b2e5faaf52da7aff89b0b0913554ee09f1c29d8c0f09900ef30cb5bf1fdbaaf531b649458cc50375ac28fb6910ec9a26cad58848c698320aef
SSDEEP 192:zDMCpsNCOQCDJnJjrHBmHKQmiU14O1mk03/irbNycItqpOm29YyXj/knt:zQCsNCOBZJjrAmXQkWOpqF75ont
TLSH
T155423A746879AC365CEBA606F44B37639FB810F7D9C42F54E9E58B1C00C729C2B1A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 96d759c2d468e49a33d6028c61f6e74e755e15851090ed71efa7e75879b3835e
MD5 1d86fd7e265a60eb1856917a874beb33
SHA1 013d4872cddc149a9f9a3686f72a4f1575f50990
SHA512 0bbf671d79c49a1733a04368ec024a24db7c0e70b2f7246500cd6df40552db66cdfd665096859bd90dbeb7ed12fe74f79175dd30e8fae290d5af8b755dcd78b1
SSDEEP 192:zDMCysNCOQCDJnJjrHBmHGQmiU13OWJk03/irbNycItqpOm29YyXj/knt:zQtsNCOBZJjrACIakWOpqF75ont
TLSH
T14D422A746879AC365CEBA605F44B37639FB810F7D9C42F54E9E98B1C00C7298271B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d7a07abd4ac9f34c11bacc1ca4bbe287f8bf48c885110034b9802ab67ffcc1e1
MD5 eda22d9faa98842cf044aa61aca9ab82
SHA1 5d2013edec908b56d4d289942e166f818b4196fa
SHA512 c92bb58d922b4f650f2499b754d55e686430710a7930d268d3d3b1bde03776dcf72fdee03c4118d06a24cfaa2fa7497086005158757c3405d072a63355f13b39
SSDEEP 192:zDMCysNCOQCDJnJjrHBmHfQmiU1KOHEk03/irbNycItqpOm29YyXj/knt:zQtsNCOBZJjrABhkkWOpqF75ont
TLSH
T182423B74A879AC365CE7A505F44B37639FB810F7D9C42F54E9E58B1C00C729C271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1327b88b68b2d54c4e6ca3ec948ff5d978920a353c63bdcca5581473f77ef076
MD5 3051981fdcdd7c0813c899afbbdd1166
SHA1 3519d8171862b31196a3956d57f6b3cddfd510b2
SHA512 5450fd7251085f3c77128a507edb3313c39adea2f48fbd6d8db4d9befbf7b5d3b34dedd027dad47b1b69767fb46632d6d5032fe98a0af25729b08c4e99453484
SSDEEP 192:zDMCpsNCOQCDJnJjrHBmHPQmiU15OJLk03/irbNZLItqpOm29YyXj/knt:zQGsNCOBZJjrAxeFkWOp+F75ont
TLSH
T1B6423B75A879AC365CEBA605F44B37639FB810F7D9C42F54E9D98B1C00C7298271A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 186e2e5b87ba042873fa9bed613faaff3fd3c8bbe9bd77164c07ae8d2bb66707
MD5 8835254177d21c7152391a24c13305d6
SHA1 4be6e0b6371d9907070fbcb3e5e27b83e65da074
SHA512 cc40fe8cde9922fb71b7069059f14442b0d97fa21194744ddc0c22a35ea3c87577a65127ff5c8175352d55e17040b6994a5df342dbbf1b53aba2fa46b6356fdf
SSDEEP 192:zDMCpsNCOQCDJnJjrHBmHAQmiU10OQ6k03/irbNZLItqpOm29YyXj/knt:zQGsNCOBZJjrAgvrkWOp+F75ont
TLSH
T178423A74A879AC365CEBA645F44B37639FB810F7D9C42F54E9E98B1C00C7298271A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3fcf392cf8a6f30c80efa0ab9099181a41f22136d8174308598ae23dd6447253
MD5 933edcb818f12cf104d56651b6bf554b
SHA1 d65a819cc3e7965b172329a66fed55264b923f20
SHA512 9e6cca4cf69cab2d713d64494d7608076f0830588f2ddf67f48644f59a15924031e3d4e773a005d5615ccdb1db769ef7b67349eeaa51213ea1b980937935df77
SSDEEP 192:uuDMCfsNCDQCDJnJjrHBmHmQmiU1eOsstk03/irbNZLItqpOm29YyXj/knt:nQcsNCDBZJjrAiFsMkWOp+F75ont
TLSH
T193423A746879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c0cf880504fbda3a4ca5de601fb31b9bd473f306de8a1ff7d0564ab41c9db78d
MD5 7ba447db7ff9773e5ffa880172566d64
SHA1 6c489a2ac5c974c79c40b19cdf6092181102c281
SHA512 fc6c0f2833cbd0e26b98a274342d1745dd52fd1fcedd1d80e638c72b59e1bc67de1044e7d2357a7668d0d3216502756cde7b401c183ce7764e0aee63031bae09
SSDEEP 192:uuDMC1sNCDQCDJnJjrHBmH4QmiU1HOcuk03/irbNZLItqpOm29YyXj/knt:nQSsNCDBZJjrA4EPkWOp+F75ont
TLSH
T17C423A70A879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C6298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2a93544fb4f7b4e8a0084485bcf8c0173bc98ae3e2afe8e744ef307c60a41658
MD5 c0941f05e546aef729f6df948eafe3b4
SHA1 c1b644253c2d17bda004a579268dcad609fb6b32
SHA512 dede32957ebb195a5cee1bf7092346602b797e59eecf2c7866e36628ba926465d54c63bbad1e53dcf7297da82f45d727e8fcbdda173c2d34a4a0207f5599c197
SSDEEP 192:uuDMC1sNCDQCDJnJjrHBmHzQmiU1aOZLk03/irbNZLItqpOm29YyXj/knt:nQSsNCDBZJjrAFthkWOp+F75ont
TLSH
T180423A70A879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7889d9458f8d833ed86faf6ddf80ff64adf4105ab6efc05ffcaa47fa7b55b733
MD5 b7a895f2de02b5b5e3ac443e12b77919
SHA1 794733c180368379f3a6e5436a9c444846913a98
SHA512 4e6da71d2c8699b5ccbda73ed07b855509205580201c33b965039fc43f0f48a7735e41c1f71b86dfd597db46fb4afb549ea92d53b46100ed18691b93e35c0b74
SSDEEP 192:uuDMCSsNCDQCDJnJjrHBmHJQmiU1SO6Ek03/irbNZLItqpOm29YyXj/knt:nQNsNCDBZJjrAHF/kWOp+F75ont
TLSH
T137423A70A879AC765CEBA645F44B37639FB810F7D9C42F94E9E98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 06985d2a4c0b9e9eb9ce607dba66ade11ed54b42f2e1968b8c19d02c6c74199b
MD5 4cec60736c4ff9752782e527529a2542
SHA1 0a7036a5ebc69de558ba63ee22f46ce74d923bac
SHA512 f83bd36e326d40d4a08df225cdd1556b9c5922323f03d49c54bd08cf000afb9a60ebacb7fd2f84c462bf1c3d043e73382608b23e74d941c3aabbb6b28cc39056
SSDEEP 192:uuDMCbsNCDQCDJnJjrHBmHsQmiU1EOpXk03/irbNZLItqpOm29YyXj/knt:nQMsNCDBZJjrAcTBkWOp+F75ont
TLSH
T16E423A706879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 52e1eea617c40d69bc62189d4b0bab5f3a2b0c86fb9ee8f9c9d4c6ddefda7cdb
MD5 8c2563ac7081c2222e56ab838f0b3276
SHA1 ea6ef2d0d4d07abe8e8c087ee697c7d008068efe
SHA512 13a31401e4c5936523aec32a79136877ce686888fcfb01d531d653e02531f0ab9e30e6014fdcdeb5ab6ee8270546248df6e42e7898f90fadacf0fdf23004cafb
SSDEEP 192:uuDMCOsNCDQCDJnJjrHBmHHQmiU1lOR/k03/irbNZLItqpOm29YyXj/knt:nQNsNCDBZJjrAJW9kWOp+F75ont
TLSH
T191424A706879AC365CEBA605F44B37639FB810F7DAC42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d3b9ec44c5088dba0812f089fa404c81fa5a05b1b73dec90898607ee24eedf07
MD5 601c7f000e5384c5130dc6a4b409d58c
SHA1 41bb67d47e3ab18e15fd2a93183ed7536862ef6c
SHA512 1afa4b5612488fd55a2334ffbf4074355a5044f12aa92c2d504de27a0a87bbf772dfc7f29fededc4afad177633c2db4bc3d8af94a021049f1a9f29d2dd58666d
SSDEEP 192:uuDMCysNCDQCDJnJjrHBmHbQmiU1VOmQk03/irbNZLItqpOm29YyXj/knt:nQhsNCDBZJjrAtivkWOp+F75ont
TLSH
T151423A716879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c7147dec7ba57a9ba250dd795868c11a239b756c932a3729c1929c0d2deeccfe
MD5 62859946361cda22b1e1663a0ea84f04
SHA1 cdb9c13b910699d8b568a7a274cc83062f0f1a6c
SHA512 bb5e75b177b146bab344fb1f97bc921727a7124cc5a10a15395444d1cf45b139637749a435f3bf5499389034750a4c7bad3b52be1da29d33b820a43ad03420ac
SSDEEP 384:nQxZcIYsNCDBZJjrALnLkWOp+F7ivC3Sooy:wYPfP6XF7i6iox
TLSH
T15C828D705C7DAC7628EBE245F58A3A675FBC50B7DAC95F40E4E9C72C00C62982B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a41591d8fe96464d0b0cdb51109feacd5a13751bb89a5a4945f5f6be4ca5b8b8
MD5 03cbab013a0dc32c1cfc44af6b0666df
SHA1 b9467b3839f43b1772db7b05be5de8ae6bbee443
SHA512 fe831f365088166e7f0661e38524421855d2662075830af0c9a10fe572810d59eee269d542ea38b91f913bcf662a0d8bbceb9006491c1b31b79ccfc2255d97f9
SSDEEP 384:nYxZcILsNCUBZJjrAVBlkWOpdF7ivC3Sooy:YLSfPemF7i6iox
TLSH
T174828D705C7DAC7628EBF242F5863A675FB850B7DAC95F50E4D9CB2C00C62982B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 80e5d1ccb58665e24af4789371a6b4080eaf0612511076a8619009ea8427e8ec
MD5 5c12db4d9b94b778310b4211c8a38975
SHA1 c1fd7e1571a5d46925b9ba609db4b73d77898be2
SHA512 d0f50d05401df33a26e3757610facd525a4d5e204bdc4835bcbeb82b94f752a1fc83579eec7cad37008ee439e580a421daee226161adb5bf14692954896fb875
SSDEEP 384:nYgZcI3sNCUBZJjrAMDHkWOpYF7ivC3Sooy:P3SfPztF7i6iox
TLSH
T1C5829E705CBDAC7628EBE245F5863A675FB850B7DAC95F40E4E8C72C00C62992B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7297e8e992d0c9bbeb0bc9d58a9abff2b0a87fef85eabb2467e790be979c2209
MD5 c694abf344979a6626262c726b207ae8
SHA1 a896b6ccafe4f93d155ad8da208a76fb4022f1a5
SHA512 0423ff68f52ec5b51f48154e45f255c34e6a6b6a4fb545eae7b34f9d8fa64958cfc59d525ac4951ff253e6b59a37662459ef006fe41563336960d8ac8fd4cef5
SSDEEP 384:nYgZcI+sNCUBZJjrATQXkWOpYF7ivC3Sooy:P+SfPJdF7i6iox
TLSH
T1B1829E705C7DAC7628EBF245F5863A675FB850B7DAC95F40E4E8C72C00C62992B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 72be3485a4744c24476956af9bf3bf82aeb7bc70bd8ad4c4ecca9f24c64cbef0
MD5 91cfa6f9a25497087041e063bc21b40e
SHA1 9927710a738dda15cca22bd3c9407ac223a4d135
SHA512 eca0b7409500c22e54d91c3bdd8dcda3a0980495413cd4471d1e40774f513c12912c2a809a10fff13da2391e256df19ecdabe6f0ac3349ebbca63269049e69d3
SSDEEP 192:zDMQONC6kmHnQmiU1yOmrk03/irbN+cItqpOm2U9:zQQONC6ZpNakWOpOF7U9
TLSH
T19622087468A9AC7B9CE7B555F08B37639FA810B7DDC56F84E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 d6842c9c6f89ab9b11d03ab6d2ed42b3d50311b42f27fbf5cbc70d97862ac23b
MD5 0ed4f2ee2b3a9f081e54455abafeb4c8
SHA1 60649db7025a0a2917f656382baac7b8b883c2d1
SHA512 e502eb261aace69523c26ac4dd72c7632d26ad82d5b8f944773dfc469e938072f40e80416b61a49faab3cbfbd913f891e6d375ee08f060b5437df8c0222f87ee
SSDEEP 192:zDMQONC6kmHnQmiU1fO7Ok03/irbN+cItqpOm2U9:zQQONC6ZpkakWOpOF7U9
TLSH
T16422087468A9AC7B9CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ae71bcd2ab5493211e300dd1cbb9cd11a37b520a8bd7363e76b1801b323a4dc5
MD5 dc620bdd0344ffec604fd9575ee5989b
SHA1 9239db99fde4de6b1a03e43f0b3b71a2a31883a8
SHA512 31a7a7e7c6a4e0b31af66023eac81880dbfecb0a724d3cf4f16cf60ec951ccd3b7014c77e9eee75db8f0620cb95eb0de4a788949f02430ef5abb04d68af77725
SSDEEP 192:zDMQONC6kmHnQmiU10OMxk03/irbN+cItqpOm2U9:zQQONC6ZpXWkWOpOF7U9
TLSH
T16B22087468A9AC7B9CE7B555F08B37639FA810B7DDC56F84E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da6f2534aef4d3473664215cdd32c796eb2e1845a596a70b402833840f6d1483
MD5 9914ab241dbd36a02c7d321e0b93af9f
SHA1 420c33b2243546c8331ed5e1358ce45dc3f9ca15
SHA512 0117ca90d43547aa23129938500acb30d1d5b549312aee20ddfb329f1592e0f1a7710e522ba73052bc9795003342b152bb8d4dd0d9208a4fd8af50cd134afb4e
SSDEEP 192:zDMLsNCOQCDJnJjrHBmHBQmiU1TOGZk03/irbNycItqpOm29YyXj/knt:zQLsNCOBZJjrA/wakWOpqF75ont
TLSH
T1B8423A74A879AC365CEBA606F44B37639FB810F7D9C42F54E9D98B1C00C72982B0A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2a82651b2d2fd0af4a5e11c9a764b5c0e86f6f9c76d5945b2be8d4e14366f3f5
MD5 d4096d57882db81df9c9291d93d5394f
SHA1 ca4d1ae2bc90f2a719da6943b082a49ebfdc6ef5
SHA512 6665f3eff99241e7464f11673ed8872a30df0e3f2e7c1d4460b52b8608e6ef968c10917f07677fc6e621dbd6c7f9647bee45f3c1498c65de598853d604e0b66b
SSDEEP 192:zDMCesNCOQCDJnJjrHBmHfQmiU1oOMfk03/irbNycItqpOm29YyXj/knt:zQNsNCOBZJjrABjOkWOpqF75ont
TLSH
T19F423B746879AC365CEBA506F44B37639FB810F7D9C42F54E9E98B1C00C729C271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c581509400827fed67f7ae833c0593f8b55840549d7a5c3e1f9b0eb66863b070
MD5 fe066157be951a2fdbf5c2a76ed78ec1
SHA1 ea131d818407ec35b07d43c841f07eb7e453a2a1
SHA512 b6b50fae3b33afbaafbc2890ee573d746164def3e54f714af6d3b809b2f3718c95d9b7a70950ce48280d4877d28a525d494029abe2a688f9b81c03e9e30a6445
SSDEEP 192:uuDMCpsNCDQCDJnJjrHBmHzQmiU1dOqYk03/irbNZLItqpOm29YyXj/knt:nQ6sNCDBZJjrAFy/kWOp+F75ont
TLSH
T18A423A716879AC765CEBA605F44B37639FF810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0c28e3b73442fc50e3a2cf0cc0d7f0e56202568720bd9488180407647df166e7
MD5 a04fc20a16d3cd6756a28ee81a193b83
SHA1 48d6bd956160e73b8756ad557a9b7f34c230aeed
SHA512 1bf8e8c1c4dcf12a710b5d75740b82a42bed61e302bf166d69e59ae51f794ea26c70faefd4a3d731560c5254c46aef9c14eb45e5f4269e6c581876247c1fca51
SSDEEP 192:uuDMCpsNCDQCDJnJjrHBmHrQmiU1IOnlk03/irbNZLItqpOm29YyXj/knt:nQ6sNCDBZJjrA9DlkWOp+F75ont
TLSH
T1A8423A706879AC765CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 923beb754b319fd6d6e13148d11d6007a64b96bd82a9c0b6670f631ae0852bf6
MD5 ae6f0a2120d2fc337da7db7e9a51c8e9
SHA1 6b47fd0305ad80b6d7e1a1595616cae4aca29a49
SHA512 f0c1921ca17b1355719543efb5ba4ee077a344eac6bbd73ef335cb9895d33ea41f84356bd9a2f52eea891538fb0bad9fa9102f44bbd6fd39fc2d8f9522c73a8f
SSDEEP 192:uuDMCisNCDQCDJnJjrHBmHbQmiU1fO4Gk03/irbNZLItqpOm29YyXj/knt:nQdsNCDBZJjrAt0nkWOp+F75ont
TLSH
T118423A716879AC365CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 57db86db42e983e4807d50a227b75377a22977ebdbeade064fea383378c6fd1e
MD5 7a74c20e86ac072bea81943b57442c6c
SHA1 2d8cef2fe7c60f8d96a06a87d041956f3a3d9ea7
SHA512 37bef8b6e82d90b93054ab0f52d1654529aef50b00776d28039d5ea510d6644fb4a6ed8731200a54ef322b3b924cbd69b52d5712b5f204c43079f0745cb78bcf
SSDEEP 192:zDMWsNCOQCDJnJjrHBmHjQmiU1oOxyk03/irbNycItqpOm29YyXj/knt:zQWsNCOBZJjrA1zkkWOpqF75ont
TLSH
T1F0423B746879AC365CE7A506F44B37639FB810F7D9C42F54E9D98B1C00C729C2B1A427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ee72ab5289df8f73e4b4b8f3a634e276446b03dbdde6c87ff882c9898b94c649
MD5 0ea1d5a6e395f63533854a6c331c3bec
SHA1 f3d5b844cf1b42517137176048efdbf15bb33035
SHA512 2aa4cb2831aa142d1126b49c04bbe8e9ba7d65c48bb6c22889c4fdfdeea83c2212d542e6a3397a5e0e546ccb3eb388ff6305dbad46241cd0241d53b97fda785c
SSDEEP 192:zDMCpsNCOQCDJnJjrHBmHKQmiU1+O6tk03/irbNycItqpOm29YyXj/knt:zQGsNCOBZJjrAmNqkWOpqF75ont
TLSH
T16C423B746879AC365CEBA606F44B37639FB810F7D9C42F54E9E58B1C00C729C2B1A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bc34d54d4835f5de2cd5fcc05ecdafdc19f577059891b10d0e8cb1cb389aafb2
MD5 4d0bd14bba7b47b6a79d6034efe27ed8
SHA1 add4172ef91ca0bfa20a3105d4485c211c674ac1
SHA512 fb85ecaf41078f314395cbab7e2151ff3c672c7af9449aadb5972ed825d56c32bad3325b65e6d9207c287c9720fc03b3afdd3b5e0ef20bf62241b01b345ff493
SSDEEP 192:uuDMCNsNCDQCDJnJjrHBmHsQmiU1wOlzk03/irbNZLItqpOm29YyXj/knt:nQKsNCDBZJjrAcH5kWOp+F75ont
TLSH
T171424A74A879AC365CEBA605F44B37639FB810F7D9C42F94E9E98B1C00C7298271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6bde34cf300fc4f2ef1db875ff6f0bdc00e8dbbe0e000f740a25a30221f731cf
MD5 67d9901ecf44a99f7e8522ce0480d164
SHA1 0649a23957aca8432fffa92d2b0b09fa31afba03
SHA512 2ee3132081520f60a065d44ea091a144b6cc7571d0905ba69a9f2844a987b354f0ffaea2356b469af4acf2317066c4f6df4a72fea2b0648b78881c6bb32351d8
SSDEEP 192:uuDMCJsNCDQCDJnJjrHBmHHQmiU1ROFjk03/irbNZLItqpOm29YyXj/knt:nQ+sNCDBZJjrAJalkWOp+F75ont
TLSH
T1AA423A746879AC365CEBA645F44B37639FB810F7D9C42F94E9E98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b4d18d104912c1acd5657d5e881a34d7d0cfe5bdc7cd128656dd8acd83b54130
MD5 51ff70cddce9d88780076f997394d190
SHA1 3e95090bdb9862404c1e1a38f0eaf375c9500751
SHA512 584211aa5ad01b46f2e948452b58f66d39f39a25cc62222fbdb3ff172da8c0f2c5fd558341b67d666ae04d11c81021b73e3200df005a2c01bc8bdda7a1016c87
SSDEEP 192:zDMQONC6kmHnQmiU1KOM8Uk03/irbN+cItqpOm2U9:zQQONC6ZppMHkWOpOF7U9
TLSH
T1B822187468A9AC3B9CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ec7f9db09c34b0f3e15d831565404dfa98007d3495e80d337b0898b9380891de
MD5 bcae4991f323282e9c77d74a69ddba6b
SHA1 a0cd4eebfbc55a1df6c893c471bf1e10a36fb6d3
SHA512 92b9384b4b5b902a607dede94c0801ebaaa25a3bb68c464adfc75406b91799d7ea84d29cb87bc759d9bba701bb05889cd8f7fb8c5b47123765b35e30dae5887e
SSDEEP 192:GONj6kyQmiUywMJ903/irbN+cRtqpOm2U6:GONj6n8J9WOpLF7U6
TLSH
T18C121970A8BDAC2B5DE3B555F08737639EA810B7DEC55F41E5D4461C04C729C2B0B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 38672f1270b0bd9ea8573d5704d041ff0b96fc0037a135906d8d5de48fc35279
MD5 64caf0090b82d48eb35578c8b95acfdc
SHA1 03ca8d7966816da9a90ae495df189bf378171b59
SHA512 c380da96c1abfc51c31200ed51e4cb68687460f5aacb42b7976ba12c738fac6f084b68a5dfe6e4ed9d138b8dd0ca278f22292717dbd8ade4c073cf9e72100065
SSDEEP 192:uuDMC0sNCDQCDJnJjrHBmH4QmiU1YOg6k03/irbNZLItqpOm29YyXj/knt:nQLsNCDBZJjrA4P/kWOp+F75ont
TLSH
T1B8423A746879AC365CEBA605F44B37639FB810F7D9C42F94EAE98B1C00C6398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 39a41ab4406db9823ae1b7e4f1cc904b0738dc2a1b26eebc2fa3b8dd8ef162a7
MD5 2954ce021821d19afef5f6ed1df3fb68
SHA1 cb7bc3b70f517a83b0bad85a5c0eef8629059232
SHA512 cc44ed24b9cc2a8263df4868df7c253959e998f6416a0f450b278b12781f6f8e1b655621b62a6694ff6ef6ecd79b6d88a0dc484a4f2f79b66f0759a2b87cf4cb
SSDEEP 192:uuDMCisNCDQCDJnJjrHBmHSQmiU1yOJHk03/irbNZLItqpOm29YyXj/knt:nQdsNCDBZJjrAudtkWOp+F75ont
TLSH
T10B423A716879AC365CEBA605F44B37639FB810F7D9C42F94EAE98B1C00C7398271A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 44f45512432e0d78c7215e79af74dcaa0cf4717282e9c187a13c4deb6aebcb16
MD5 25d78efcd27a4309f06eeafd3f784114
SHA1 b9af9c04b81ddc389a0695ef29066f5e9410d0eb
SHA512 6d7ee62cb762ffba7c85e3f577eff2f7c282a5801c5c406b79dbdf4f11b5b7a5acfd2635c8005aab894229681404d6cec244aa4181624dfbd5d7c92955591095
SSDEEP 384:nQxZcILsNCDBZJjrAaLzkWOp+F7ivC3Sooy:wLPfPpfF7i6iox
TLSH
T118828D705C7DAC7628EBE245F5863A675FB850B7DAC95F40E4D9C72C00C62982B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bbc2f986bdd047d81ebee33096ea620443af40a25abfbc8c1cada7c943a600b1
MD5 2548b9017d37d4350c078a507ec8f274
SHA1 48568ffb0f24d994e0b4a7fc75d0dbcffb9737de
SHA512 8f31ea3ae3922f2defaa81021df79721d1f985d1f0b8087a676a34115472d8667088f98f4d4f9711c63bd6802431e14084ffece8fda1db067af9af1dca688b17
SSDEEP 192:zDMCesNCOQCDJnJjrHBmHPQmiU1nO70k03/irbNycItqpOm29YyXj/knt:zQNsNCOBZJjrAxkYkWOpqF75ont
TLSH
T1AD423B756879AC365CEBA505F44B37639FB810F7D9C42F54E9D98B1C00C729C2B1A417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 84f15ecaae2ed92584702dc168f19bae47aca79604f72c6acd22b6d79ba5fbbe
MD5 329ccf8e7f6886a788634e67236d5e78
SHA1 e901ca28a3177c59a6be74df0dba7cbc86669cc2
SHA512 6f2fd3fcc3e73b3b64a3b975756d5189b192f2140add3544085a1b0e4beaaac452b3e073874bdc0c49bb40c76bff54ca474fea99609ade42c169e47b9218a78c
SSDEEP 192:zDMQONC6kmHnQmiU1gO41k03/irbN+cItqpOm2U9:zQQONC6Zpj2kWOpOF7U9
TLSH
T12522187468A9AC7B9CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 75ba969cb0befe85c0fcb9aac14894c0be3c4a25ac8533757f84e464ac4bb5db
MD5 d7667052d7b04a2a89c92dbd73c94e1d
SHA1 971fc8bfb900b2522bcd888166658417d1cbb2c0
SHA512 265eab147388b8294270426824bc215f08ce8e4369061e7404234e9659258fb5ca26b8f94631d5b75af6f56d9940a133128ad66f56db818041af33d45da3a05f
SSDEEP 192:zDMQONC6kmHnQmiU1JOC/k03/irbN+cItqpOm2U9:zQQONC6ZpiSkWOpOF7U9
TLSH
T1A722087468A9AC7B9CE7B555F08B37639FA810B7DDC56F84E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ea9468a1ed1c7c2d58f62f0c4c384ee010771dac3e36317f2b9c1ab63d8b9060
MD5 da445f5830d69a81a1575b3de757c631
SHA1 799425473c5626a58387a5dd9ec85384a02d71ee
SHA512 bd9cc6fd18578e4a61530c2155246b4c242c73dbf7c14a8392fd750d5a295452968389525b1f565ead738ebbfd47c4573946b684d3801ce7aa5f5e6437795116
SSDEEP 192:zDMQONC6kmHnQmiU1EOXyk03/irbN+cItqpOm2U9:zQQONC6ZpzCkWOpOF7U9
TLSH
T1B922087468A9AC3B9CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1fbe3b76fd2e2d6af38a0e7ff527abe96c7fa2df9eb4657ccc8fc4d6ceb57e6f
MD5 03fb2ec451db6e6a9fbcb250f7cc481d
SHA1 4e910f4b24cd8bc7804b04b7660a3c93ad73855c
SHA512 ef8cb217f5cb3f7dc3ee9feb2cee5907a1dd4cd2f68898de24c54d45363570b93fe22a7645397b2ebbfe13ae4266c9735a871bad007c63860714cf09a5f98b75
SSDEEP 192:zDMQONC6kmHnQmiU13O0Zk03/irbN+cItqpOm2U9:zQQONC6ZpwWkWOpOF7U9
TLSH
T11622087468A9AC779CE7B555F08B37639FA810B7DDC56F44E9D84B1C00C72982B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dea3f7d7-2ce4-48ec-9186-ccec5043e3ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dea3f7d7-2ce4-48ec-9186-ccec5043e3ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6b2916cc-9f41-4542-a69a-17ae2116b040.tmp

Path C:\Users\Admin\AppData\Local\Temp\6b2916cc-9f41-4542-a69a-17ae2116b040.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12962\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be2d90be-a034-4b95-baaf-6bcbf445e2a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\be2d90be-a034-4b95-baaf-6bcbf445e2a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b27bc9a0-6a71-42f7-b8d0-008ffdf70af6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3564_1368607787\b27bc9a0-6a71-42f7-b8d0-008ffdf70af6.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ehnqqd5a.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xsvjh7zo\ehnqqd5a.exe
Size 5.4MB
SHA256 3cfa21bee5820a17191f9540f116589f6c931e2505c3a96388063d0ba8c900a2
MD5 3afe7058403650f98d66ad06c21ec7e0
SHA1 bca1fa05996e42fd86832abcf220ad5e3834639b
SHA512 4e896d023ef93966419752ebd88b13f83fb5497541854b135ea0b55d1ad4f944b96e87bf6f4fefbf70074bf96a98fa70d4251f848b6901789b99146eb82ca025
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRE:OrICteErownP0oTcMsABqlaOz6
TLSH
T13E463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1204-618-0x0000026C32EF0000-0x0000026C3323D000-memory.dmp

Download

memory/5160-761-0x0000015CF11D0000-0x0000015CF11FA000-memory.dmp

Download