Overview

overview

10

Static

static

3

02eb38806d...8b.exe

windows10-2004-x64

10

02eb38806d...8b.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    63s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 09:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b.exe
  • Size 5.4MB
  • Sample260821-k232sa1vbw
  • SHA256 02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4047
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3496
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user7456
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8953
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3599
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4505
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4963
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2009
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2554
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1820
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3037
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8769
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5740
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2276
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8503
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5203
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3798
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8254
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user7446
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2667
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2931
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1344
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5180
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6684
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3231
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6852
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8576
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1489
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user6292
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3080
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3253
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9615
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2216
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2266
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1702
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4070
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8229
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4826
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user3289
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user2994
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user5334
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1587
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user1289
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user8146
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user9993
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user4678
  • Password

    password123

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    user7312
  • Password

    password123

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Views/modifies file attributes 1 TTPs 11 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b.exe
    "C:\Users\Admin\AppData\Local\Temp\02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6852
    • C:\Users\Admin\AppData\Local\Temp\02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b.exe
      "C:\Users\Admin\AppData\Local\Temp\02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4228
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe"
          4⤵
          • Views/modifies file attributes
          PID:6816
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x390,0x7ff98efec188,0x7ff98efec194,0x7ff98efec1a0
          4⤵
            PID:6188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12350802339023219263,4192784312775462555,524288 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
            4⤵
            • System Time Discovery
            PID:6704
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,9894536205406688339,1423568249711850008,262144 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
            4⤵
              PID:5080
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,14706040330042076266,12295619019547795135,524288 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
              4⤵
                PID:7084
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15430218892657865258,15767261732523480436,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                4⤵
                  PID:712
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,6191558940808494956,1598147254400850054,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                  4⤵
                    PID:3956
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,16471615465911657173,9631374432080555203,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
                    4⤵
                      PID:1508
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4484,i,12196262572094834084,7161858540651661298,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
                      4⤵
                        PID:2424
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4436,i,17151075361613451807,6721607800473951544,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
                        4⤵
                          PID:5168
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4844,i,2140645814641408764,13317095628414179063,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
                          4⤵
                            PID:4608
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5796,i,5406200971740771295,4390005204662968203,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
                            4⤵
                              PID:3440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5876,i,4922778115203428121,9188411765828506903,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
                              4⤵
                                PID:3680
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6164,i,647197351202578112,11901015925229914497,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
                                4⤵
                                  PID:2116
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5872,i,1506634467898954161,9561470067905306321,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
                                  4⤵
                                    PID:3732
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6432,i,4199601615165733714,8311869277102696781,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
                                    4⤵
                                      PID:5748
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6648,i,7428689315656771218,4032154523026341089,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
                                      4⤵
                                        PID:5556
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6720,i,8837196738949420467,1334446272542940531,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
                                        4⤵
                                          PID:6192
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7012,i,16812191068997951337,12447118781881050217,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:1
                                          4⤵
                                            PID:6940
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7172,i,17083487340084389613,5485224024044860129,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:1
                                            4⤵
                                              PID:6248
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7328,i,4860960993860773974,6975597697071936923,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
                                              4⤵
                                                PID:5100
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7484,i,9353819768512314178,7271509065186981678,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
                                                4⤵
                                                  PID:4728
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3227901669653385610,9472566742482234600,524288 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:12
                                                  4⤵
                                                    PID:6692
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6652,i,2574229967453637876,598651618721292750,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
                                                    4⤵
                                                      PID:4080
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6868,i,17794452350526456508,5176864303416949735,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=8964 /prefetch:1
                                                      4⤵
                                                        PID:5916
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7680,i,8859400899895432531,14714777149499359601,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
                                                        4⤵
                                                          PID:4128
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7676,i,14002382856731185196,14421906751026361574,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
                                                          4⤵
                                                            PID:2584
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7920,i,15406835909090592675,1067017559359242466,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
                                                            4⤵
                                                              PID:3784
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8124,i,444829646801628025,353751817228264967,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
                                                              4⤵
                                                                PID:5284
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7740,i,17102188935481341035,7183719646437668064,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
                                                                4⤵
                                                                  PID:3220
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8164,i,13283953627326295774,7300550009100142684,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:1
                                                                  4⤵
                                                                    PID:5576
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8208,i,17565040235189339257,14064257917702401317,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
                                                                    4⤵
                                                                      PID:4508
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8228,i,4554385095178080497,17125301583751822490,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:1
                                                                      4⤵
                                                                        PID:6440
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8160,i,2704212074224153501,15329229969187100497,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:1
                                                                        4⤵
                                                                          PID:1156
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7752,i,12096512744864134740,18276040413970572041,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
                                                                          4⤵
                                                                            PID:1820
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8276,i,8449864751510846754,18321843841579561216,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:1
                                                                            4⤵
                                                                              PID:4908
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8568,i,13024251895026841697,9728758801061600922,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
                                                                              4⤵
                                                                                PID:6536
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3632,i,2273085110992479832,2416052550826514054,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9400 /prefetch:1
                                                                                4⤵
                                                                                  PID:3444
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8324,i,10661779434935871941,10874417395877458437,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9296 /prefetch:1
                                                                                  4⤵
                                                                                    PID:2604
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8420,i,471070333623224565,15543391745538688895,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9308 /prefetch:1
                                                                                    4⤵
                                                                                      PID:6680
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8460,i,2431545232707790473,8552133159222999681,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9320 /prefetch:1
                                                                                      4⤵
                                                                                        PID:3672
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8348,i,4875439731765244957,13254357662318182871,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:1
                                                                                        4⤵
                                                                                          PID:2164
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8300,i,10565887739291281096,7965285046922477416,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:1
                                                                                          4⤵
                                                                                            PID:3644
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8480,i,6140602363059481344,13643667232023166515,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9340 /prefetch:1
                                                                                            4⤵
                                                                                              PID:1308
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8804,i,15163161386786251662,7371732017631636400,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9520 /prefetch:1
                                                                                              4⤵
                                                                                                PID:5320
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=4548,i,8912180171112882915,6386519923110952225,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9660 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:6636
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8844,i,2986037313010855408,17843100475205884499,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9784 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:6356
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=4692,i,17680166578909763052,14534927425429115666,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9536 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:1684
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8932,i,4801867842141218785,17076334386596779109,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9652 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:2268
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8612,i,9383627095952544085,3125341589464399963,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9576 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:5568
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=6300,i,1299875082146283531,3934344985309490199,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:3468
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8512,i,17345983567079345075,5473696079698804039,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9360 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:3288
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8856,i,7105111174997001632,13346603286946877864,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:1032
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8840,i,10502568158398739320,12243840153032882749,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9624 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:2272
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8908,i,5819420370489849669,15320730604895266888,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:5336
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8872,i,5376941010795313084,13653714912079899890,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:704
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=4668,i,7196603197657237493,6722270374640172658,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9528 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:4700
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8536,i,8869480763253019559,11168879526832115486,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9464 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:3688
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8588,i,13094850059399581496,10118572614110730553,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:5944
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=4676,i,3519911206841014856,8998596468179451547,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:4972
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=4704,i,14486066901067310036,815609506676932960,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9544 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:5816
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8304,i,17057402466091423112,11351278432144708912,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9288 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:6152
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5408,i,357868212605358116,16379560809851741113,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:2132
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=14168,i,3878461916398725733,15422301141854507737,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=14184 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:5160
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=4548,i,6220617939189178813,3167377684398700208,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:8112
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=6216,i,13525850254171165470,16054013835172843536,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:3224
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5780,i,4420333853913127898,1535490273169697327,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=14348 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:2044
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14852,i,11902713478776520097,7974027481518338284,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=14884 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:7488
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14924,i,7010677209176662519,18264157806180803429,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=15004 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:3004
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8260,i,6897393666262442919,7653604523650975400,2097152 --field-trial-handle=1928,i,4015958182818454528,10856699777028696242,262144 --variations-seed-version --mojo-platform-channel-handle=17728 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:9248
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                3⤵
                                                                                                                                                  PID:3600
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4304
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3464
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5548
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:900
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4556
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                          PID:4084
                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe"
                                                                                                                                                            4⤵
                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                            PID:3296
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3416
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5500
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5284
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4344
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4428
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2484
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:5560
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qlpb8wwj\ik4gym72.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3540
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                          PID:2920
                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:4396
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:7136
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4664
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:6848
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:6312
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:4648
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1312
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ymtoalhe\xuvdyusv.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3804
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                        PID:3708
                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                          PID:5600
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6696
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4540
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2780
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1820
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6540
                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4364
                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zwytsymx\0164bc8s.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                      PID:5432
                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:7024
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4696
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:764
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:7156
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sykj45yt\05487l2a.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                    PID:4560
                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:6808
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:6440
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:804
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5976
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8qnfrqqe\uns21weg.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6544
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                  PID:5008
                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                    PID:6916
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:6204
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5384
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1056
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1s1bcpjj\8c6t3z87.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                PID:5716
                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                  PID:3356
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:8064
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:7016
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3876
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:8140
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:8256
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1od1bdvu\8ilqsvak.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:8340
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                              PID:8416
                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:8480
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:8548
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:8648
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:8720
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:8776
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:8800
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:8884
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\og3mka2j\ohcx5osy.exe
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:9016
                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                            PID:9068
                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                              PID:9160
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:9212
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:8284
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:8448
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:8548
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:8772
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\29caddzo\jc3wxn9q.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b655s5d5\0wz8ek1q.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                          PID:9060
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b655s5d5\0wz8ek1q.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                            PID:9072
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3056
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:8948
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4052
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b655s5d5\0wz8ek1q.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b655s5d5\0wz8ek1q.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:9280

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                      • SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      settings.dat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                                      • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      5117100d-80e0-4ba1-830f-dae8d513942d.tmp
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5117100d-80e0-4ba1-830f-dae8d513942d.tmp
                                                                                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                                                                                      • SHA256 d43413c2d8180387bc8e57e3383d7086928afbabccf1e799028e37cb308293a0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000064
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                                                                                                                                                                                                      • Size 282KB
                                                                                                                                                                                                                                                                                                      • SHA256 51e850c34c6234bfc2398bb758ea65a0a7436581ec068e7e47ba5e6caa482c95
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000076
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
                                                                                                                                                                                                                                                                                                      • Size 22KB
                                                                                                                                                                                                                                                                                                      • SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_000077
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                                                                                                                                                                                                      • Size 37KB
                                                                                                                                                                                                                                                                                                      • SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      f_00007a
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
                                                                                                                                                                                                                                                                                                      • Size 31KB
                                                                                                                                                                                                                                                                                                      • SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 eed93441629b87556968146772229fcb23166cb54c72b92f19bfb1ca435ab4f4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      the-real-index~RFe59df0c.TMP
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59df0c.TMP
                                                                                                                                                                                                                                                                                                      • Size 3KB
                                                                                                                                                                                                                                                                                                      • SHA256 572243e8a9b6435e4165c651900d668ac708817babc0e5a290a25aef72caf869
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                      • Size 2B
                                                                                                                                                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                      • Size 40B
                                                                                                                                                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 17KB
                                                                                                                                                                                                                                                                                                      • SHA256 bb5c57bc63e23e9ed0cfeef7f8e5b0e0d19b1239c513672113342d041b0b8cfb
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Preferences
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                      • Size 16KB
                                                                                                                                                                                                                                                                                                      • SHA256 8924271325c698c6038bf637bdbf14ca6ecfea74519f3294138a6065e4ba9570
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 26KB
                                                                                                                                                                                                                                                                                                      • SHA256 b69be528423a7656c402b032472e4278d43782d9ec4b4a51f70bfac6f2a9dc04
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 24KB
                                                                                                                                                                                                                                                                                                      • SHA256 33cd946aa81519f91ca62faac445dee18e3c4e8e135411a92909b33cfcf344a0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                                                                                                      • SHA256 4fa7e0ecd2d69b023ceb1ed6369797c49c65c0fe71a7f5c94748b9756c91d11f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Local State
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                      • Size 27KB
                                                                                                                                                                                                                                                                                                      • SHA256 6c5ef466368860d6c68e72db3948e1f7c3926f2d21b1b5238173d800de99ccbc
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                      • Size 94KB
                                                                                                                                                                                                                                                                                                      • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _bz2.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_bz2.pyd
                                                                                                                                                                                                                                                                                                      • Size 84KB
                                                                                                                                                                                                                                                                                                      • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _decimal.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_decimal.pyd
                                                                                                                                                                                                                                                                                                      • Size 265KB
                                                                                                                                                                                                                                                                                                      • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _hashlib.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_hashlib.pyd
                                                                                                                                                                                                                                                                                                      • Size 64KB
                                                                                                                                                                                                                                                                                                      • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _lzma.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_lzma.pyd
                                                                                                                                                                                                                                                                                                      • Size 159KB
                                                                                                                                                                                                                                                                                                      • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _socket.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_socket.pyd
                                                                                                                                                                                                                                                                                                      • Size 78KB
                                                                                                                                                                                                                                                                                                      • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _ssl.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_ssl.pyd
                                                                                                                                                                                                                                                                                                      • Size 151KB
                                                                                                                                                                                                                                                                                                      • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _uuid.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\_uuid.pyd
                                                                                                                                                                                                                                                                                                      • Size 23KB
                                                                                                                                                                                                                                                                                                      • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      base_library.zip
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\base_library.zip
                                                                                                                                                                                                                                                                                                      • Size 711KB
                                                                                                                                                                                                                                                                                                      • SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                      • Size 3.3MB
                                                                                                                                                                                                                                                                                                      • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      libssl-1_1.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                      • Size 678KB
                                                                                                                                                                                                                                                                                                      • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      python39.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\python39.dll
                                                                                                                                                                                                                                                                                                      • Size 4.3MB
                                                                                                                                                                                                                                                                                                      • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      select.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\select.pyd
                                                                                                                                                                                                                                                                                                      • Size 28KB
                                                                                                                                                                                                                                                                                                      • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      unicodedata.pyd
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI68522\unicodedata.pyd
                                                                                                                                                                                                                                                                                                      • Size 1.1MB
                                                                                                                                                                                                                                                                                                      • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      nlnzywix.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fic6w4mb\nlnzywix.exe
                                                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                                                      • SHA256 02eb38806d4f125ab175e04015a5b048110f3a6bae8394534c69e192fb92d18b
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download