a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad

Analysis

max time kernel
5s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
Size 5.4MB
Sample260821-lr276scj21
SHA256 a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad
MD5 d209cadb650abc4073c02f500173a0e7
SHA1 36de3d472be0021d4880e09a6a25db5de1fba88a
SHA512 0d6fc49a40df01b4ec3f4ba663f756f7a02719da2db586ddd1778d0ba179cae6f6fd42af444963e1e60ea5257579b8b748ae2ca11c42e6eb3c9a312c2df0029a
SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1K:Hdx2ICteErownP0oTcMsABqlqBn0
TLSH
T19B463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5639
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6958
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3468
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1636
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7252
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9506
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6676
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1163
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5166
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9572
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4200
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1670
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5721
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4379
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7776
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1233
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9348
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3546
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1833
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4659
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2278
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3508
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1699
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3668
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9147
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5807
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3662
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8051
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8982
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1391
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3081
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4431
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8599
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8582
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8691
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5142
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6417
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8706
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5117
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2991
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5362
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5569
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5322
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1666
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9055
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7316
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6610
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1044
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5803
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1240
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2015
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6123
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2880
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9192
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2087
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6986
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5851
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9494
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6018
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3092
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4888
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6810
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4606
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1158
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6291
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7939
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5772
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4253
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7414
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3561
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9842
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2884
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2956
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9710
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2752
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5028
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1786
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1639
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7140
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4819
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6367
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5312
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6049
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9516
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4640
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9882
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8628
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4759
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4883
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9309
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7353
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2863
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3568
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4752
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8054
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6825
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2155
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8141
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5495
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1340
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4016
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9937
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2906
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3003
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4681
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6979
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7053
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3437
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9421
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2127
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5811
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5645
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4042
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3783
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1529
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8820
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7236
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2620
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5744
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2388
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3890
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4872
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7823
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9821
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5000
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5572
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6988
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9539
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9662
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4366
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8473
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3410
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6201
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9585
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9036
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1182
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7989
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9798
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5750
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1941
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2444
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1923
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5757
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5320
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1248
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9951
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6460
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2962
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5429
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8179
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4345
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2837
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1673
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9260
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1006
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1338
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4770
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6523
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7133
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2075
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7111

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5812
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5737
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8986
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7306
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9212
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4598
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3705
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1159
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1282
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6293

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6855
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1805
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7940
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6561
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7827
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2366
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9605
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9114
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1701
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1115
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1854
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6672
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgsf6z.exe	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cgsf6z.exe	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe

Executes dropped EXE 2 IoCs

pid	Process
1100	8abq8ssj.exe
1408	8abq8ssj.exe

Loads dropped DLL 23 IoCs

pid	Process
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
1408	8abq8ssj.exe
4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\qdh7361l\\8abq8ssj.exe"	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
199	ifconfig.me
210	ifconfig.me
238	ifconfig.me
2974	ifconfig.me
4740	ifconfig.me
431	ifconfig.me
2269	ifconfig.me
2673	ifconfig.me
2729	ifconfig.me
4600	ifconfig.me
4684	ifconfig.me
182	ifconfig.me
217	ifconfig.me
580	ifconfig.me
1298	ifconfig.me
1307	ifconfig.me
2589	ifconfig.me
73	ifconfig.me
118	ifconfig.me
149	ifconfig.me
718	ifconfig.me
1069	ifconfig.me
1219	ifconfig.me
1986	ifconfig.me
2432	ifconfig.me
1297	ifconfig.me
5	ifconfig.me
60	ifconfig.me
242	ifconfig.me
3486	ifconfig.me
3509	ifconfig.me
4088	ifconfig.me
4395	ifconfig.me
1245	ifconfig.me
81	ifconfig.me
127	ifconfig.me
279	ifconfig.me
1541	ifconfig.me
1599	ifconfig.me
2845	ifconfig.me
23	ifconfig.me
468	ifconfig.me
737	ifconfig.me
1178	ifconfig.me
1486	ifconfig.me
2224	ifconfig.me
3115	ifconfig.me
3156	ifconfig.me
193	ifconfig.me
1654	ifconfig.me
2402	ifconfig.me
2872	ifconfig.me
3308	ifconfig.me
3343	ifconfig.me
3615	ifconfig.me
462	ifconfig.me
715	ifconfig.me
1081	ifconfig.me
1290	ifconfig.me
1762	ifconfig.me
3005	ifconfig.me
3011	ifconfig.me
3667	ifconfig.me
284	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6568	cmd.exe
11484	cmd.exe
3820	cmd.exe
1508	cmd.exe
1732	cmd.exe
10484	cmd.exe
7824	cmd.exe
8644	cmd.exe
9368	cmd.exe
6524	cmd.exe
6328	cmd.exe
2448	cmd.exe
932	cmd.exe
6648	cmd.exe
8984	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4708	3008	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	84
PID 4708 wrote to memory of 2448	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	85
PID 2448 wrote to memory of 4524	2448	cmd.exe	87
PID 4708 wrote to memory of 1060	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	88
PID 1060 wrote to memory of 2908	1060	msedge.exe	90
PID 4708 wrote to memory of 3492	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	91
PID 4708 wrote to memory of 1380	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	92
PID 1100 wrote to memory of 1408	1100	8abq8ssj.exe	94
PID 4708 wrote to memory of 3380	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	95
PID 1060 wrote to memory of 1872	1060	msedge.exe	96
PID 1060 wrote to memory of 4420	1060	msedge.exe	97
PID 1060 wrote to memory of 4420	1060	msedge.exe	97
PID 1060 wrote to memory of 4420	1060	msedge.exe	97
PID 1060 wrote to memory of 2652	1060	msedge.exe	98
PID 1060 wrote to memory of 2652	1060	msedge.exe	98
PID 1408 wrote to memory of 3820	1408	8abq8ssj.exe	99
PID 1060 wrote to memory of 3952	1060	msedge.exe	100
PID 1060 wrote to memory of 3952	1060	msedge.exe	100
PID 1060 wrote to memory of 4000	1060	msedge.exe	101
PID 1060 wrote to memory of 3952	1060	msedge.exe	100
PID 1060 wrote to memory of 4000	1060	msedge.exe	101
PID 1060 wrote to memory of 4000	1060	msedge.exe	101
PID 4708 wrote to memory of 4808	4708	a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe	160
PID 1060 wrote to memory of 2476	1060	msedge.exe	105
PID 1060 wrote to memory of 3148	1060	msedge.exe	106
PID 1060 wrote to memory of 4644	1060	msedge.exe	107
PID 1060 wrote to memory of 2476	1060	msedge.exe	105
PID 1060 wrote to memory of 2476	1060	msedge.exe	105
PID 1060 wrote to memory of 3148	1060	msedge.exe	106
PID 1060 wrote to memory of 3148	1060	msedge.exe	106
PID 1060 wrote to memory of 4644	1060	msedge.exe	107
PID 1060 wrote to memory of 4644	1060	msedge.exe	107
PID 1060 wrote to memory of 4560	1060	msedge.exe	108
PID 1060 wrote to memory of 4560	1060	msedge.exe	108
PID 1060 wrote to memory of 4560	1060	msedge.exe	108
PID 1060 wrote to memory of 1688	1060	msedge.exe	109
PID 1060 wrote to memory of 1688	1060	msedge.exe	109
PID 1060 wrote to memory of 1688	1060	msedge.exe	109

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4524	attrib.exe
6076	attrib.exe
6728	attrib.exe
10088	attrib.exe
10488	attrib.exe
4104	attrib.exe
3076	attrib.exe
4168	attrib.exe
8804	attrib.exe
9892	attrib.exe
12144	attrib.exe
1180	attrib.exe
6700	attrib.exe
7524	attrib.exe
9228	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
"C:\Users\Admin\AppData\Local\Temp\a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe
  "C:\Users\Admin\AppData\Local\Temp\a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe"
      4⤵
      Views/modifies file attributes
      PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffa9a36c188,0x7ffa9a36c194,0x7ffa9a36c1a0
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,9807664705831344180,5033431066128268778,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
      4⤵
      System Time Discovery
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,10340875476361603479,1423724537729971708,262144 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5812602877833030215,7073714784803525333,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14024345230729012845,13140257150670694761,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,10752281168719492665,10906333337978006396,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,7539710340244962946,63484285915731667,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:2
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4500,i,16396620216691093368,5829779576427013688,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,14241868834509498903,1827041215525284675,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4984,i,11061867179548102582,16600880726305406189,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5148,i,14962026772288851759,10330906289292318670,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5640,i,14907190761876575992,5578168509635458332,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10847641358931401303,8777338187161030808,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4420,i,11932157763608699547,7024514613120457591,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5828,i,10344401216118642512,14587905099267339383,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5848,i,18444346565644846100,4852190671928233619,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:1
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5876,i,11172257854305057305,4135002963076072651,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5912,i,11023985504960209043,6592937417372368119,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5920,i,11186460143330743308,15856793862136322320,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5892,i,6092708156729772001,8127027150877605534,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:1
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5968,i,583886290622123760,10004308739508794422,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5988,i,1373623562880196541,1075452967138603514,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:1
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6016,i,7498871042235213071,10591111929049125869,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6048,i,1341404754661353660,15720883992788662711,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6196,i,8220966004739458004,13891334473888252579,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6202834446457653757,16248193247688123244,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,7783879576358386283,16916675623351118513,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6500,i,3221314554682251964,17009526770326201328,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6576,i,957331998565858792,16024659970075623507,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:1
      4⤵
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6624,i,9957141079334728333,17378983067116624566,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6584,i,5450460579916740912,18353663673917228289,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=6604,i,2560903264886451779,9390182057146136948,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6664,i,3347794490043827936,4282939767267032521,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6548,i,16637130617618954071,4298290069926128138,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6696,i,14403916458690249621,7551426884940768777,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6808,i,4618691461040494444,10838137793896150555,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6836,i,16357077901226886350,7679678804311758169,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6860,i,2454917217028428307,15208775228457897576,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6888,i,5082412224018357493,8691780788210621208,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6900,i,17122095888622836215,4446831817774526146,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:1
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6996,i,8440202192084144995,3375648316002557190,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=8056 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=6952,i,11155829979553841434,4077274179657274489,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6976,i,4200762165488866829,4098952792125841394,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11184,i,8772172601355250176,6804872351147122885,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4980,i,15557123054421754009,7736363916535885501,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8472,i,13409352833443450288,7543001272334876135,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=11596 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11748,i,9777775354625954618,10516006287650108945,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=11760 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=11880,i,13529783706331955744,7504795648027220319,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=11888 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=11900,i,16508038061540777622,4370545858005651281,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:1
      4⤵
      PID:6204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12228,i,9277365614651864477,17674283812091894433,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12208 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12440,i,3987244245910185987,8407194760551384710,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12456 /prefetch:1
      4⤵
      PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11684,i,3216566131207330168,1807872623219316913,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=11728 /prefetch:1
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12712,i,3645364924486319991,8271321346493928615,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12724 /prefetch:1
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=3528,i,9379553939385690266,11313681791241716146,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=3644,i,13192971208187017621,11668892055487201560,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=12952,i,7685248588634609736,4353574419874209984,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12980 /prefetch:1
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13108,i,932789404571402802,1245790291930999523,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13112 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13172,i,17941986979466358487,12530809102904746931,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13268 /prefetch:1
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=13316,i,14394415921152474820,14498506642974496036,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13428 /prefetch:1
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13564,i,1239665953507366100,9052000548277670202,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13476 /prefetch:8
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=13564,i,1239665953507366100,9052000548277670202,524288 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13476 /prefetch:8
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13676,i,3594460821370761543,17083486501366767029,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13696 /prefetch:1
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=13880,i,6444903792920611502,10257119507677040960,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=13892 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=14024,i,7444624235312634,13571861761202013246,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14044 /prefetch:1
      4⤵
      PID:6380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=14188,i,3316010631705154708,260291529679305890,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14212 /prefetch:1
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=14340,i,8131804163325517031,566113242816407703,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14356 /prefetch:1
      4⤵
      PID:6892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14492,i,36545453431197377,5877508611129951002,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14512 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14516,i,12141918828516971170,8339661443409417693,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14704 /prefetch:1
      4⤵
      PID:6532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=14840,i,14753411588372134799,13128924720488429140,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=14848 /prefetch:1
      4⤵
      PID:7236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=15008,i,10313234899479777775,10787403542973746766,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15012 /prefetch:1
      4⤵
      PID:7304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15152,i,2143607882367916774,17128332705257909969,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15156 /prefetch:1
      4⤵
      PID:7388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=15328,i,12031004124387458599,6070234190437755602,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15292 /prefetch:1
      4⤵
      PID:7544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=15492,i,16556735955574657107,8626186022126430248,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:7576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=15512,i,4504903974889657673,6646638108369518170,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15604 /prefetch:1
      4⤵
      PID:7640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=15660,i,15074537831314665425,6874696601167325211,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15752 /prefetch:1
      4⤵
      PID:7648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=15892,i,174484454083773695,1560925562458307082,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15908 /prefetch:1
      4⤵
      PID:7688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=16068,i,1324198034376382048,13692574736002155967,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=16052 /prefetch:1
      4⤵
      PID:7868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=13880,i,4659304744499741860,16616592041086799941,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=15176 /prefetch:1
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=14048,i,4689320004132455965,9957098587374584382,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
      4⤵
      PID:7424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=16328,i,5759549881339023510,6296662068153803885,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=16320 /prefetch:1
      4⤵
      PID:7740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=16532,i,1231662032157156703,7688241455838623553,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=16544 /prefetch:1
      4⤵
      PID:7528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=16708,i,5804208512387632544,7504949080507768300,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=16508 /prefetch:1
      4⤵
      PID:7668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=16840,i,2743807567997618065,11305896990696100656,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=16824 /prefetch:1
      4⤵
      PID:8280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=16328,i,9569389912709395235,3104998758516675516,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=17000 /prefetch:1
      4⤵
      PID:8316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=17172,i,5945388890688738893,9727656653857860393,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=17164 /prefetch:1
      4⤵
      PID:8556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=17320,i,18118269857648755014,15163090531018468678,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=17364 /prefetch:1
      4⤵
      PID:9180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=17480,i,15483309875519548179,16584041892239062992,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=17488 /prefetch:1
      4⤵
      PID:8536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=7468,i,17310671792836113382,14961369590647802255,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
      4⤵
      PID:8648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=9236,i,3362385148676837538,13985127040549983732,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=17744 /prefetch:1
      4⤵
      PID:9188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=17760,i,14908707433854660963,8478516192803556016,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=9796 /prefetch:1
      4⤵
      PID:8500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=17788,i,13226062671227418201,10660889225751032084,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:1
      4⤵
      PID:8640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=10576,i,13908133027091892706,5513058128633994385,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=10648 /prefetch:1
      4⤵
      PID:9012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=7460,i,17765878997244879829,13783451182110782443,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
      4⤵
      PID:9248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=6156,i,8786315191531733704,308462115098264926,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=18440 /prefetch:1
      4⤵
      PID:9400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=17852,i,11884936186381459058,727884147634941453,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:9508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=18724,i,11791534138634120815,2570552246341587661,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=18764 /prefetch:1
      4⤵
      PID:9672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=7268,i,8413248366374083335,17469548710450001922,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=18920 /prefetch:1
      4⤵
      PID:9844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=18964,i,5828847107181696424,2069084224842336264,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=19048 /prefetch:1
      4⤵
      PID:10000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=19176,i,1780592286022006118,13497805590513638991,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=19184 /prefetch:1
      4⤵
      PID:10008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=19312,i,16171050875645775335,16124197609936401493,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=12604 /prefetch:1
      4⤵
      PID:9256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=7060,i,14145430154411020525,17686110081852671157,2097152 --field-trial-handle=2252,i,5709742914298385084,5734734754859221655,262144 --variations-seed-version --mojo-platform-channel-handle=11108 /prefetch:1
      4⤵
      PID:9692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4808

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3820
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe"
      4⤵
      Views/modifies file attributes
      PID:1180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1436

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe
1⤵
PID:4156
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m0mszgbw\wwylg1au.exe
  2⤵
  PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe"
      4⤵
      Views/modifies file attributes
      PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3312

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe
1⤵
PID:1660
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6ccs7xf7\gf1qv4g3.exe
  2⤵
  PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe"
      4⤵
      Views/modifies file attributes
      PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4040

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe
1⤵
PID:4148
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q5m4yjok\nkw2b9m6.exe
  2⤵
  PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1732
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe"
      4⤵
      Views/modifies file attributes
      PID:6076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6288

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe
1⤵
PID:6500
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ivvb377\0s92oxeu.exe
  2⤵
  PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6648
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe"
      4⤵
      Views/modifies file attributes
      PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6408

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe
1⤵
PID:6976
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g11p4him\vhb9tp7g.exe
  2⤵
  PID:7152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6524
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe"
      4⤵
      Views/modifies file attributes
      PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6748

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe
1⤵
PID:1848
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\38hz10gc\4l9sf56e.exe
  2⤵
  PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe"
      4⤵
      Views/modifies file attributes
      PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7616

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe
1⤵
PID:7704
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\43vhmsve\1rgnjexn.exe
  2⤵
  PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7824
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe"
      4⤵
      Views/modifies file attributes
      PID:7524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8292

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe
1⤵
PID:8464
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xdnr7z2p\qun27zq6.exe
  2⤵
  PID:8540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8644
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe"
      4⤵
      Views/modifies file attributes
      PID:8804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8904

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe
1⤵
PID:8864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd06hy4b\4nryprvv.exe
  2⤵
  PID:9000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe"
      4⤵
      Views/modifies file attributes
      PID:9228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9228

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe
1⤵
PID:9988
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\up4d3tau\30dgr249.exe
  2⤵
  PID:10220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9368
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe"
      4⤵
      Views/modifies file attributes
      PID:10088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:10848

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe
1⤵
PID:10056
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mrkk1p7f\xc4p3ux7.exe
  2⤵
  PID:6672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6568
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe"
      4⤵
      Views/modifies file attributes
      PID:10488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:10496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:10324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6896

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe
1⤵
PID:11212
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnl7nb00\ahohjqdv.exe
  2⤵
  PID:10376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe"
      4⤵
      Views/modifies file attributes
      PID:9892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:12016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:12180

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe
1⤵
PID:11316
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\toujb1sg\wqo6t0ia.exe
  2⤵
  PID:11416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu5uk6en\gflhjibi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11484
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu5uk6en\gflhjibi.exe"
      4⤵
      Views/modifies file attributes
      PID:12144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39949be0-76da-4e2a-ae2b-936449f9b611.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39949be0-76da-4e2a-ae2b-936449f9b611.tmp
Size 11KB
SHA256 7c8b87b42129cf3e5dcf21672086df4f19cae7ed1b22b8e08399355a09e2802a
MD5 4c8882f57711e0153de5f715a4766712
SHA1 ab34b9bc6543052c3c6a2c94a1279c9fa9927780
SHA512 b1a5be839758b46de9fb79352c3bc2e92ee0d472e7833fe2fca73bcf7658220d5c25a66aaa3e3f63048da8c962a1a9876705c92189d98e2ce8e58457e6c8da0a
SSDEEP 192:uukksNLIQ0dfuM7bdmQmiU1IT3kMTA++FdLCgFd3EZ8z1sqP/L8UMZ:n5sNLIz7xCaUNdtdU+NIUMZ
TLSH
T10F4218316CB89C279AA7B145F48A37939FF0207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 282KB
SHA256 51e850c34c6234bfc2398bb758ea65a0a7436581ec068e7e47ba5e6caa482c95
MD5 f88654445271c1eb4deb64610eeaf703
SHA1 070b6547efae9b83885d01a4189b3915aff96d23
SHA512 977734f52640a632136e66efbdf9e56d9202deebe752b8cc033623f4ca10d21fa8208e3b1d12154e4284ae2881c007a9fed655902df2caedc7de64b74dd68a2b
SSDEEP 6144:uzaJQehk3mfKzVLixCOix18atTGTYen5/o5XlSn1Ew:U3mCpH1BTGzsXlSn1V
TLSH
T1115423149B4D02116BF9C02A2B5A4949DF89648DC0850DF6F8EA3E27DD00BBE0AE75FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 75796a156908c9cde0c416d0d4e1231777522eb7e34199052791416c8079c6fb
MD5 c9dbc3c7016422b50cce8ca95f69a77f
SHA1 f3e8cf9aa618ed6f34981fd344520087542a558c
SHA512 b3472ff9bf67a784f26c90c452124eb0043d404e7570e4fa6eaa37dc8b08bf38ba77aa400879c3e0c69d5cd41b787a627eee54f08038f796bf7a90f4bdbfd412
SSDEEP 192:sxZaRlyM/jK1Ml8Mjw/fas+HoV2EdpLLyFH/W6+WNcS5GD/YvhzjXHIgyJ:sxZaF7w/fas+H8qRbzcD/2/3O
TLSH
T17C52D9126A345A77CCDBE219FA51BF53D6F50462A2D05E44AEFCCA1C04E7AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 81f12195fb6e7096549f1740c7d74804757556432f199577c88a157b23af9e61
MD5 1746938b6d3cbf1463167c1a28935b4b
SHA1 cd3cd294b4335c428bc37cdfa16f32d948d8c944
SHA512 c2f4ef2aa54ad0219fbb9c0468c9e3cd8e2616a3e70cd951d6909f1e2b91888a504d262221e5a6951bb48f722abf35b2a262f34c4991c47f525a16d06d60cfcd
SSDEEP 192:sxZaRlyM/jK1Ml8Mjw/fasdHyV2EdpLEJ6FH/W6+WNiM4LB3dDzhYB9DMjXHIg5v:sxZaX7w/fasdHq9RbKZhhD31
TLSH
T17252E912AA345A77CCDBE219F951BF53D6F50462A2D05E44AEFCCA1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bfb8aa15f3235ed1d06ef2d2f700ded7a1a55de241d04c6fab2c96127e9524eb
MD5 7e7c8789a546d63d407ee2870bb6cdf2
SHA1 fdce3e245f839facdcd49ef5d00284d5456b8ab6
SHA512 4e8e0d400637f1c404e15e038faf22626ea252eac86b2a8f1818cf91b0f888f93e27102f71897604d780f8d7de53fa2ff10f2085cf27b1e84da7efac8ff7b529
SSDEEP 192:sxZk9RlyM/jK1Ml8Mjw/fasdn3V2EdpLZ0iz5aFH/W6+WNiaRrRCN7zpehYB9kyd:sxZOX7w/fasdnn8RbBcghj3bq
TLSH
T10662D852AA745A778DDBE219F940BF53D6F50462A2D05E44AEFCCA2C00E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2e643e08d63580998e02b9d477c8afc231b628069946ed445f3c3c54bd0533aa
MD5 bff99ecc5685ca706091ab0dc973fb3a
SHA1 34c2598cdb56961ec031e9a24ec39c6e7467a676
SHA512 0fcc5d82c5dd4365979231a897d20d10c135b52d85daf3f346e352cc050f6606efa07a4de7f79751a2eccafb0c8b38defc1d223e84f5c4d72dbe1dc210a853a6
SSDEEP 768:tdseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pperoj7:tdseJ3xWvhfynu1jaVcL88p1P
TLSH
T1C2D20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c8e5e7b2b963b2571e2a9384e7134753c434ba53fa1c9416378e63b33a6459c9
MD5 b8be43e41c476ccf9344acb14f3c4386
SHA1 ca4b38262cf5b92c0f567db64cd8d7c03b84e49f
SHA512 eb219306d6dbc9bf201cf7fac3646cd61ebc84455fcdd2bea2e0446dff14a3316f5ee94f3e76b04ec6164ca294392af9c961b5b6e161e63dd42c23469e156d48
SSDEEP 48:KYHIhKggkXypQIzKpisnypvKLfhVpk5V0PI0nkKDBrJkX/0aUhL:KYH+KggmKQIKpieqcAKN2+
TLSH
T16C919B16313B07427CBD2858A2E695379E413763341479AF7FB940624E27E622EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ff706dc2a88caf04c379de1bb279deb69b388dd51895e4583bb95c921bccd36b
MD5 d40da49346b86c281d94d5efcd8fedc8
SHA1 3726e45aac3928e3145e4c125d6fef6cef86509f
SHA512 06b78f479e47fe0f082ffe3b379aa1a974f7a51e6f7016985081cfdfb1ed0f3f9bbe2ce9c6ebdce20758dbbf85eabde6f5bb1bd70b5632b3a7a199761aa41c28
SSDEEP 192:zRsNLvQ0dfuM7bdLQmiU1cTv1MTA++FdLCgFd3EZ801sqP/L8UMZ:zRsNLvz7x9mdNdtdUfNIUMZ
TLSH
T13F3208316CB8AC2799A7B149F48A37939FB4207B9DC49F94FAD95F1C0197398230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30d4e441dfdbc0119b149dcefea102fa90876b2e0599cfabeeea0c6bce9c0e64
MD5 027562a708b8090ac30d46408a327d3f
SHA1 682743c6f3912894a14e4331be443eb94c0e9bb1
SHA512 41e8bdf004f992ba6d11abb70d045398abd40333d8e52a90489848ee4e0c2010b3904af8fb5af674b3094ec8bb3fadc8c5468582591913c456a8c7a66e75cbd7
SSDEEP 192:lONF6vMtPQmiUyZaThTA++FdLR847l4U/u:lONF6UtRfT+dV2U/u
TLSH
T16E02F835AC786C7BEAA7BE45F48A27175FE4216BA5D05B90EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dada1b4c603c060c46c1761ae17302c2c508b69bf11c4efd09c7aaf533568b52
MD5 c5a677b75a30cc64e8d840334887c02d
SHA1 c949da372147c339a91de3adbbbfe1ad6a121248
SHA512 d554ff7799d35fbd19c406c157741cf01c3eef7d56edca9ca90ec7477e5e5d6b46e7e82c82eec8591335ff16c1675dc4dfd3e598acc786cff476742bbbeea360
SSDEEP 192:zkBsNL1Q0dfuM7bdlQmiU15Tb1MTA++FdLCgFd3EZ801sqP/L8UMZ:z8sNL1z7xDn5NdtdUfNIUMZ
TLSH
T1383208716CBCAC2799A7B149F48A37939FB4207B99C45F94F6D95F1C0187398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 824c38fa692fb5cc0551104441402a89a6db854e761cd84e49725ffae51b3df9
MD5 9138bee755512a1e80447acf3045f3be
SHA1 9d35b12ca71038239e1dde9b2ef95fc3e4d4daec
SHA512 96b143bd9104a67522606b8ccfd8caafc42359b4678a54a072afba3208762ab969e08cde00446b3835aaff113dd723ed773ff50a08a4d49e72a525f14ae56ce6
SSDEEP 192:zkBsNL1Q0dfuM7bdBQmiU10TsyMTA++FdLCgFd3EZ801sqP/L8UMZ:z8sNL1z7xf2/NdtdUfNIUMZ
TLSH
T13D3208316CBCAC2799A7B149F48A37939FB4207B99C49F94F6D95F1C0187398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5b2dc26b1d4553701f05a9fadafed76f708eba13a2e38b75fb8a30d89cf5ec61
MD5 3db6ff1bfa9cd30d6a226ce2f9ab5b14
SHA1 47bcb5680085e0d0ddaa65e4153577c2b8ac2d84
SHA512 52d11c6160599d54cb256c576b600825d5b07833d604da9adcc5a0432d63b5bfe41ba248e7c937da22348f0647eab6f13e677630cda846d5e278067f573655c7
SSDEEP 192:zkN5sNL1Q0dfuM7bdsQmiU1jTw2MTA++FdLCgFd3EZ801sqP/L8UMZ:zI5sNL1z7x8ZnNdtdUfNIUMZ
TLSH
T1B33208716CB8EC2799A7B149F48A37939FB4207B99C45F94F6D95F1C0187398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8e831d24e9938e40f75d61e30b6ebb236d2d3f36d96a3345744381d615eed608
MD5 7910a799e65af0094254d39866cfcd04
SHA1 1eb7008995024345dc915e67554bcb0c3ae895a6
SHA512 de900b4821fd3da998744e6c0fd4f0845c18886677e81406f4cde3fcd18f223a4f707f3b3855dedab33caeb8c985889d68b227d1a3bf62a0cb650a863bb4157d
SSDEEP 192:uukCsNL1Q0dfuM7bdsQmiU1MTUbMTA++FdLCgFd3EZ8z1sqP/L8UMZ:n3sNL1z7x8CuNdtdU+NIUMZ
TLSH
T11B4219316CB89C2799A7B149F48A37939FF4207B99C45F94F6E95F1C0187398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d148ab1e8b492338b981e66a05776a9ef01620299edb618f8b9badd99244f431
MD5 ce3e6ef8f9c16a1ece9860d4ff98f13d
SHA1 36b851b7ffff176bb300eca6b1c80f9a14380db3
SHA512 8045000be627f8cda44e69e7467bf46cfa84d4ab5c0ffb2c8ad0b39340da923bc1881ab076ee9960417cec4d8cb03a451887055aefaead1a9da557b1bec328e3
SSDEEP 192:uukFsNL1Q0dfuM7bdtQmiU1dTY3MTA++FdLCgFd3EZ8z1sqP/L8UMZ:nYsNL1z7xr7WNdtdU+NIUMZ
TLSH
T1234219316CB8AC2799A7B249F48A37939FF4207B99C45F94F6D95F1C0187398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 555b71f70ba224e1f3ac2cd9eb6f91271f9943e0950a3216b0249387eda9b05e
MD5 9adbd748adde675e833c18865b65091b
SHA1 67f22d92e3577c7ef2ef091c26fdea6e0ac08c79
SHA512 6c5875f2b990f0123cfdde15a428d62767e83b52a43f9d8467a4f5700749730a4c8a6be1327ae0fddae63ed2a4ffd70361b3daca62e1d70c3750565613a8b7b8
SSDEEP 192:uuk0sNLIQ0dfuM7bdBQmiU1/TduMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nRsNLIz7xfBQNdtdU+NIUMZ
TLSH
T1344218316CBCAC279AA7B145F48A37939FF4207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f642cfcfadfb420074a69f2aa0956d071c815eb3bb8b209b61d2a65a57f16ec
MD5 5052947e9483d16fce3acc80d69c0e6e
SHA1 9321510afded92e7880d6de1bafacba0e05acbd9
SHA512 2e72dffb94bcff25f289a460b8c09f320ca0845e42da69d3756a952ce4c9efc3f4b6b8c9e228ef1d9bf59e8bde0144eaeb87d2b9bdb89b9c1b03c5fefd50d090
SSDEEP 192:uukAsNLIQ0dfuM7bdBQmiU1NT9stMTA++FdLCgFd3EZ8z1sqP/L8UMZ:ntsNLIz7xff9MNdtdU+NIUMZ
TLSH
T10A4218316CB8AC279AA6B145F48A37939FF4207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 359f6a9ea71173b04bd30fc419f2dee44fa20885be01ff532faba2cf8b72ad60
MD5 43f15a917f5d4b2b7f9bfa4e31c03a4e
SHA1 35d6ac8c2fb58df8e10f6326200aad00ca6cd4f6
SHA512 07ee0116ce5ce65cc6667e02142b5586f104f4ebecc23cca122561beb9684ea592eef497679b93bd36ab59b79bc2ede6637a7839075a5ba120693c925b266740
SSDEEP 192:uukVsNLIQ0dfuM7bd9QmiU1HTChMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nEsNLIz7x75aNdtdU+NIUMZ
TLSH
T1254219316CBCAC279AA7B145F48A37939FF0207B99C45F94F6D95F1C0187398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c57ddbba3eab60e9446504725a98e778d8a8fd9d120c78fc6a6c708fd4f9cee4
MD5 bb81034cf78d4c28ad990e453fea9dc0
SHA1 98e631da622ec4c884308aaf9b3ba29abed66174
SHA512 29f836831fd8a5fa42f886b6c8fcf5956256ed1a8b08b0aac74fb7e37d056ecc74df8397a5ab0eed64fad2203b37846c0c165b1d120d6393396173ce4d110e3d
SSDEEP 192:uukjsNLIQ0dfuM7bdaQmiU1aTRuMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nesNLIz7xWYgNdtdU+NIUMZ
TLSH
T1074229316CBCAC679AA7B145F48A37939FF4207B99C45F94F6E95F1C0187398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 43287f8865655a9c3b21dcb284b6eb52f099b2ed284b2c8df4b6a4ddc222d843
MD5 28916a76d6207b4789ce0ea47962780d
SHA1 c508126024e0fd2b7bb595766ad6ba762e6937ed
SHA512 7641e6637d261762c0488e3d968609a6d51b99e51c92d53fceecc79c435259af79b0cf88eb8abad766f2be6ab06c21b266d02687763c8e00998e478fa61ee33b
SSDEEP 192:uukbsNLIQ0dfuM7bdTQmiU11THIMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nSsNLIz7xFDoNdtdU+NIUMZ
TLSH
T1B74218316CB8AC279AA6B145F48A37939FF4207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 cffc2132dab272a4281d3fbe8480e0db65f962e10e65d4a1122e437ae8c8fb2b
MD5 dd1d1bef1a302705231a2898dbada62c
SHA1 a5e24cc15a60da435192dc81c7a056f289de652d
SHA512 089c447ba808c1ca263066e9368c256ab584f38946ca71e9bff66665eef43fd757ded0c7f8172902da1e61c6c97fe5b2df2a04d86d31fc0149ec7f1a39de9b18
SSDEEP 192:uukhsNLrQ0dfuM7bdCQmiU1tTTEMTA++FdLCgFd3EZ8z1sqP/L8OE:ncsNLrz7x+/wNdtdU+NIOE
TLSH
T1D34219316CBC9C679AA6B245F44A37939FF460BB99C45F94F6E95F0C01C7398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5b063a98e2799cc383d05eac5519c99bddf0bb6d73602f577f8bea9e5e4d0ff6
MD5 7668128f953dcdc622894d703904c326
SHA1 562e9b193a343b684019cdfda691827e4517aea6
SHA512 6470e02b66251920f329c24e5a4cd2718b58f1b38f4727fc892f1bdba260639cb403148719e2760f671491e203a33506edcf99108cd3a5f70e0c146f60ca518a
SSDEEP 192:uuktsNLuQ0dfuM7bdYQmiU1YTkXMTA++FdLCgFd3EZ8z1sqP/L8kE:nYsNLuz7x4ueNdtdU+NIkE
TLSH
T1E64239316CB89C6799A7B145F44A37939FF420BB99C45F94F6E95F1C01C7398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9706495f2faaacf66f15a57990c2aa1e6e17dfdeae22cf99ff1aa71076e71151
MD5 6ff4e8e2c9354eab14aa6d95853eb3d9
SHA1 961165d57ef831eec141d907206f1b7456f885e3
SHA512 35475c5b67f62057f891f97b7023a2bbb28ef565b6de20be4fdd4ec040b5fde4006c5e1d65fafc11e7629a876e99e0ea4b2d62a9814e10fa6b534c9212b98c20
SSDEEP 192:uuJlLsNLuQ0dfuM7bdhQmiU1eTydMTA++FdLCgFd3EZ8z1sqP/L8kE:nJZsNLuz7x/w6NdtdU+NIkE
TLSH
T13B4239306CB8AC2799A6B105F44A37939FF420BB99C45F94F6E99F0C01C7398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4c4640c0b82687c8433ce5eaaa555277708eeac55706fce49fe5869df500fe61
MD5 d44cf3ff3d2a97b6113c21889fd15a52
SHA1 39a83b34c87241664ce978038486bdbe19d1fdf8
SHA512 dda6ead53b38d86544d0183b3ec15801f932212de1a0b371d546797f6231cef765982a21d7ddbf9f3a6ab7820c0324d5e4b9445344a65067bc6a6a316570bd40
SSDEEP 192:uuJlBsNLuQ0dfuM7bdhQmiU1PTw/MTA++FdLCgFd3EZ8z1sqP/L8kE:nJ7sNLuz7x/1WNdtdU+NIkE
TLSH
T1484229716CB89C2799A6B245F54A37939FF420BB99C45F94F6E99F0C01C7398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 516a2fe983ace9422804912ecb1f0cd7f174efc48a40fe8805e8c96b3669d493
MD5 930d497357dd3365ea4347fc66081c5d
SHA1 1f58a8a5154a97af0c588f516ef7433f507be17a
SHA512 ce9e236cb448daf323ecf2de7699bafa614d99cf65357e53cc970743e797eaea4b1d37d566170ef57c2a57490a8308f9ceb35a3148ab210c5bfbd9a4b08ae25a
SSDEEP 192:uuJlAsNLuQ0dfuM7bdIQmiU1KTGQMTA++FdLCgFd3EZ8z1sqP/L8kE:nJ+sNLuz7xosPNdtdU+NIkE
TLSH
T1874228306CB89C2799A6B245F44A37939FF420BB99C45F94F6D95F1C01C7398230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fd938da30f4bc5dbaf696bcc539214f657207bd88b42e57604cdc5dbf0fe2f22
MD5 b967bef933a81509ac028a831958a454
SHA1 2fb46531ef35dc57beba26ddc59d530ffa95b519
SHA512 8bdf8edb3006a169b7611c13feb558052356e5dc9d3b1e5f79101e9d0e1134fab186f1e4559836dd4e407f059265cdc8a5349f379792469e9e89ac936ed458d6
SSDEEP 192:zmONL6vM7bdhQmiU1lT7ZMTA++FdLCgFd3EL801sqP/L8U/Z:zmONL6U7x//lNdtdUxNIU/Z
TLSH
T1532208316CB8AC6799A7B145F48A37935FB4207B9CC4AF90FAD95F1C0197388230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 1ee941f34107828d1eca8f5d5206b7321a3f2ee2382500068f5f2490c0c42b8f
MD5 bd3778c3320aac55847edd5b9f39ba5f
SHA1 ab7c36dcfa6b8ddbef4514987d79565aff89eb70
SHA512 64ad313ab462f5d1f43256b5872d049d12a88c6fa6b9b233701dc4737e55d2cc5063f03bef8dd17ee21b395570e5647311deebacbea8952c187c20def1f72858
SSDEEP 192:qON+6vMrPQmiUy8akhTA++FdLCgFd3EL80IsqP/L8U/u:qON+6UrR4k+dtdU8NIU/u
TLSH
T133120871ACB8AC67AA97B105F48A33935EE4217B9CC49F90FAD86F1C01D7758230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1920845b21c53ce8700cf4f6a5eecd75c20b971efc1a9beff42124a5e24e4dd9
MD5 684eed3f0585d923333c9468b4d4687a
SHA1 ff0f54d59bca0e8e002d4d717601fe8d4a7c398a
SHA512 8b2641a9f52ac0864a4ec7a3ee544e97aa3d9acf45d567a58110b418b91b2c0619cc40f1a557507fb849ea830fd1391916fbcdc1d4017d1b9a600a53f593dd58
SSDEEP 192:uukksNLIQ0dfuM7bd9QmiU1CTmtMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nhsNLIz7x70aNdtdU+NIUMZ
TLSH
T1624218316CBCAC279AA7B145F48A37939FF4207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 88f2d2b4736a5f43cc265bd4bb9431326d61ba8067e60fcefa865c8e5d2a61a0
MD5 23e076d50f62de2626bd1fd7784721dc
SHA1 53e55cfbd82d8fdecd533d6f9d5861b1d4bb4bc2
SHA512 55a6eddcafc64240846161472a2c1f3f61be6df468c3943816fc05aa60685f7076f06add3edd38f17d9cdefa2171108c2cfc4415317fadcbcc64b2e0f18b0c4d
SSDEEP 192:uukCsNL1Q0dfuM7bdBQmiU1RTDoMTA++FdLCgFd3EZ8z1sqP/L8UMZ:n3sNL1z7xfjUNdtdU+NIUMZ
TLSH
T1EA4207316CB89C2799A7B149F48A37939FF4207B99C49F94F6D95F1C0187398230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5c607b1d2a2e65a24e4a9f2ce0d33c42bda19e4218d8d91fbf2464ece0849494
MD5 a6d40f358df99bb7d8440fc4b6a8a799
SHA1 f861387d00dca53c2f61985a6d0f186ab01f7566
SHA512 3a320867081b69cf12040003b20541b3cd2227f57ddd3fb63fe7a352ad8289b60a55e113d5645b44c36947618fe0b24431e2efa17f8e152f0fd72e810f8cbb33
SSDEEP 192:uukFsNL1Q0dfuM7bdBQmiU1aTx+MTA++FdLCgFd3EZ8z1sqP/L8UMZ:nYsNL1z7xfogNdtdU+NIUMZ
TLSH
T15D4218316CB8AC2799A7B249F48A37939FF4207B99C49F94F6D95F1C0187398230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9d483969caac23a731f089694961ba4fe61bc8631d6f3a1d11e03517a6986227
MD5 3a636852a04a33e4270ac91af92f9d23
SHA1 e06dcf56c5fdcc0a1ef9d5f487b3fa4fca416f92
SHA512 d638f53e6788fd145db6fa0d11057abd96e2f695d4cde10a6b81b81e73e794f40b90001c69e4a724ccb66dc726ed352accf8635d99fcadcdc3dc9e7d6a61ec44
SSDEEP 192:uukksNLIQ0dfuM7bd6QmiU1bTG9MTA++FdLCgFd3EZ8z1sqP/L8UMZ:n5sNLIz7x2FGNdtdU+NIUMZ
TLSH
T1554219316CBCAC279AA7B145F48A37939FF0207B99C45F94F6E95F1C0587398230A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1399f8bff01542fb92f19e1c4b41d8c7ae35688cb90367ea5d355b16eb86c4a4
MD5 bdb6a739721c173b7e6cb683f13caddc
SHA1 f1dd1d694a65e817959792e3b54d1bd687f385ac
SHA512 f2945f2544d9504faec219d3c4f8f7ae39a9be448ed39dcbf942897bd0492dd3b841b90d45e836ad8f5f8d628caad545a81e7002c01b0f59b7a9e02e693d8f2b
SSDEEP 192:uukIsNLIQ0dfuM7bdaQmiU1hT0LMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nRsNLIz7xWnKNdtdU+NIUMZ
TLSH
T1884228316CBCAC679AA7B145F48A37939FF0207B99C45F94F6E95F1C0187398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c12132ddd3989a76b7d1b02108ffe33122ded6c34975ee4551b034ff507c2f1f
MD5 74486d5c5cce94b74629f72d0e23db2f
SHA1 f8720a024cd55b53709a7002e472235b24ed6fb3
SHA512 86a1f578b320e103efb4aefd0a72a4148b206b0b0184ae53ef1e744c63adc3cec02d56197c3454a2b4ed4aadc31e7b4b9030d104b4cc4996e00ec34a4272970d
SSDEEP 192:uukIsNLIQ0dfuM7bdQQmiU1cTjYMTA++FdLCgFd3EZ8z1sqP/L8UMZ:nRsNLIz7xQ2UNdtdU+NIUMZ
TLSH
T1774219316CBCAC279AA7B145F48A37939FF4207B99C45F94F6E95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bcd7a275bbfc673e87a53cf48de69f236f49b470c516860f14cc6f766a36a095
MD5 b91f50c79c0760bea95cf22fadd15e75
SHA1 3f1e525f2aa556bff5e437c4f402af3187b4b5dd
SHA512 408c9853bad3507f8f8388f623281f7ded75592df6828ff0fe3f76b8df632fd887b84c026711dfe1fd7bda386fa801dc8147e62336019bbc150d102b6eb8af44
SSDEEP 192:uukhsNLIQ0dfuM7bdTQmiU1XT1eMTA++FdLCgFd3EZ8z1sqP/L8UMZ:ncsNLIz7xFNoNdtdU+NIUMZ
TLSH
T17D4218316CBCAC279AA7B145F48A37939FF4207B99C45F94F6D95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4325c2d4f4ca565856d1c9f145ea7bcfc12e36fc0e0ded2a871128be5f23e30a
MD5 28466197d6a5f1f9595e4abb934f2da0
SHA1 82a5c26612c1241020efb568313a4730e1356bc0
SHA512 fddbaa8a314d9e8306b122843e378e3f050fa95b826ed4fe56ad8a5f5ac42b0f7bce1bafbdb77afa37a337318c9787c9c6a2cd0b449cb7a31db10d028f04e79b
SSDEEP 192:uukhsNLIQ0dfuM7bdCQmiU1HKTWRMTA++FdLCgFd3EZ8z1sqP/L8UMZ:ncsNLIz7x+xi6NdtdU+NIUMZ
TLSH
T16D4219316CBCAC279AA7B145F48A37939FF4207B99C45F94F6D95F1C0587398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 dbabc7f16e064c88bfbb4e4a11a803989316f3f475c249d6d824196d6690b34c
MD5 5c9a9bfc90ffd420ac05cd9bb05ca14f
SHA1 aa9295c1e2bea751cb7e319387fd024b28ef2a68
SHA512 fd5b8cc6adb4b7f5e944c57ee19ecd5830ad77dce8dce11f1f6f74d3c99f23f708648d7b726b255854d6bce1f22526f515855474902510a3122a2c1c125ef06b
SSDEEP 192:uuJlLsNLuQ0dfuM7bdVQmiU1rTBqMTA++FdLCgFd3EZ8z1sqP/L8kE:nJZsNLuz7xzxgNdtdU+NIkE
TLSH
T1394229316CB89C6799A6B145F44A37939FF420BB99C45F94F6E99F1C01C7398230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 180da6aa61e3638bb2484724d595889b969181ceca33d1336d84377d4476fd6c
MD5 f1ab7ce61a00a69078ca0c2563759114
SHA1 c7e9b0538813d2071a25db1295f503e6280e4c10
SHA512 6b7eb342c3ffe7f840464c17b5ad13bea0e9c00d74bfa259b2c0055bada961af1dca7d487ae2e38dc811d0fb58812e5abec158e2a9ae8256dcd164b6aca3f634
SSDEEP 192:uuJl8sNLuQ0dfuM7bd9QmiU1iTPsMTA++FdLCgFd3EZ8z1sqP/L8kE:nJ2sNLuz7x7UkNdtdU+NIkE
TLSH
T1F94229716CB89C2799A6B249F44A37939FF420BB99C45F94F6D95F0C01C7398230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c3c74bfebd84092a8d7983a3516b3ff1d44a84d016f37c1826fbe44429d22748
MD5 7c24b4d5a302dd3b2bcd787ac79e945e
SHA1 a5e84a95b16cd6afeccf1b0dd98f4192bac3a193
SHA512 5b72ccef7ff7434ee5b219c0a6f731c019fcbe7a5dea29c60e5d5e96940a0aa125a180ba190ae1d32f54ac3a67ca3afcf0454b6056d649603f46310a6bc50681
SSDEEP 192:uuJlFsNLuQ0dfuM7bdFQmiU1TTdGMTA++FdLCgFd3EZ8z1sqP/L8kE:nJ7sNLuz7xj90NdtdU+NIkE
TLSH
T1E24229716CB89C2799A6B245F44A37939FF420BB99C45F94F6D95F0C01C7398230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ab59f6c0bb5a7c3e1386de98c3fc8e360503b7708cafd480d74db95ac04cd2ad
MD5 51c12fedfac9dbd359cd5173112b54ad
SHA1 2fda630951a6c6c7917360cfdadd6957af84eb74
SHA512 43ceab0fe18fbeb6b822311c5f257dd2df7d08c5df08aed0863b706ce82d25b9169617b01adf9f6a8036b1a57356a813468e70d0e3bccf9737478168e02b850e
SSDEEP 192:zMsNLvQ0dfuM7bdLQmiU1aTdrMTA++FdLCgFd3EZ801sqP/L8UMZ:zMsNLvz7x9IxNdtdUfNIUMZ
TLSH
T1A53208316CBCAC2799A6B149F48A37939FB4607B99C49F94FAD95F1C0187398230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9f45656adb9ed74db1afabe8b78d0ba7fc1ab43abc88c5c3c28bacc34c04ea73
MD5 38901c8f5597e38adadb4959fff26b0e
SHA1 2598c9d0059007d10cf49812542573e29e9357f5
SHA512 8316de9e9818f5bea89f1cc9fcb16b26af9ffb1f3b4fab6860a5a2a543aa19e7f900ed5c52d6265e477ad08e6f41e2f828b111d9620bad2e4e3a99deecf54f9d
SSDEEP 192:zmsNLVvM7bdhQmiU1hTQyMTA++FdLCgFd3EL801sqP/L8UMZ:zmsNLVU7x/XRNdtdUxNIUMZ
TLSH
T1FD22F771ACB8AC2799A7B145F48A37935EB4207B9CC4AF90FAD95F1C019779C230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2108a081235cd77c8466391e1ae978a33c6dfdaf3785eeb5fac54c1ef053ffb2
MD5 064b8dd2abc1dc8102c7fd919836418d
SHA1 eddb688000883ed8546a7a9b6ee815ea268f7ccd
SHA512 d1a53d00958319a4a255421ee9fc999cc76047bd2990581d4d9fce954590616e4d75f75e7250ee3fc9a5e5ac0a0fb672d82b41c17bfa57a1b40da15e7d9f002f
SSDEEP 192:uuJl8sNLuQ0dfuM7bdIQmiU1UTeFMTA++FdLCgFd3EZ8z1sqP/L8kE:nJ2sNLuz7xo+eNdtdU+NIkE
TLSH
T1364229716CB89C2799A6B245F44A37939FF420BB99C45F94F6E99F0D01C7398230A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2424240f4227f35369d7cd2d300191f8c9a0afdbdc82788fdd5cff5a8895c568
MD5 33d6f06da7dc87cee38bf05a25c50665
SHA1 0840876c5f6cf9090e66c5a6e62979981ccea386
SHA512 5f6f2c48a260c71041d298ba6f463cf0357e7dd22d5efd0ebddc2115e266e8296069184fb4713532944a26a48c6019b0ddc265f37c953c736a9b01ab9308a2ea
SSDEEP 192:uukAsNLIQ0dfuM7bduQmiU1+T7UMTA++FdLCgFd3EZ8z1sqP/L8UMZ:ntsNLIz7xqQwNdtdU+NIUMZ
TLSH
T16B4218316CBCAC279AA7B145F48A37939FF4207B99C45F94F6E95F1C0187398230A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 da28576c8733cd8fbb3aefea1be0f2875b4cbb64e4ee55551a3392d75f6d621d
MD5 035c2adaae11ffae6928f5db59f15677
SHA1 8766457a1420afc37edd6a7822a4c9ed341b9264
SHA512 0f5fa606ca6c7359afd0a16588f454660a479e4b1f2c4375c64ef6e0087f95438555b8eaae482a972555218ec4bfbe94e430eb8cf13d6d26ca526a0ef20f2f33
SSDEEP 192:uuJlFsNLuQ0dfuM7bd+dQmiU1GT+5MTA++FdLCgFd3EZ8z1sqP/L8kE:nJ7sNLuz7x+b8KNdtdU+NIkE
TLSH
T1D34229716CB89C2799A6B245F44A37939FF420BB99C45F94F6E99F0C01C7398230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c03d9017f56c7042b3fb82607e296a4eae9c5d8b2994d95144d8193276071a31
MD5 47d3d35399c706f6fa2d9e67df557df2
SHA1 fddda0a27145b80020235e9ad20d952658279571
SHA512 8d073a0d79234f59fa11c63f3072861e2f9102454237edf3d290d386fd9faa63178e5578da0ab2d743b0b238bebd6011bd1c97c5e6dd7ab3d84f7fd0b42c0abd
SSDEEP 192:zmONL6vM7bdhQmiU1bTV8UMTA++FdLCgFd3EL801sqP/L8U/Z:zmONL6U7x/lVHNdtdUxNIU/Z
TLSH
T1B2220831ACB8AC6799A7B145F48A37935FE4207B9CC4AF90FAD95F1C0197388230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 941eebb13caae8cf2140d10e82486c614f14a37ea983de5ebca60691c141e749
MD5 98b753aec5fa74a6cff983f6d423cec1
SHA1 a56ce5bacc246b0ce664c50fd7de77bd8d8fd96c
SHA512 13d5b874cc9ab7525deb6010e3eada7362411e1f5da040297cf5108d6d65114c24c4dd776837ca683aec69c3ba1ebfa5e9c12a2e13f56093c5b325539f912ea4
SSDEEP 192:zmONL6vM7bdhQmiU1OTJ/MTA++FdLCgFd3EL801sqP/L8U/Z:zmONL6U7x/EBNdtdUxNIU/Z
TLSH
T132220831ACB8AC6799A7B145F48A37935FB4207B9CC4AF94FAD95F1C0197388230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 948204fc6f826f1e1a60064c5e676b4dd11a8823de8c4724fe005e3086cfbb7b
MD5 a7d159a6a3ff177cc38bc777185915ce
SHA1 4e4257841463fa7f3d35fcfe212555aeca8d94d2
SHA512 e492b6ac87709bcd953e965301206db7dd8062f1a59f0085f2fd999bfe5be72e05c6d17a052f43d622644342842c0ed9ab5389b37bd5fae80c6a28cd6a468a45
SSDEEP 192:zMsNLvQ0dfuM7bd8QmiU1nT0OMTA++FdLCgFd3EZ801sqP/L8UMZ:zMsNLvz7xMxRNdtdUfNIUMZ
TLSH
T1D83208716CB89C2799A7B149F48A37939FB4207B99C49F94FAD95F1C0187398230B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 584B
SHA256 89b5861d616260e91f1d3375b1481361800152444099d67875ba9d2dd4bf5c81
MD5 80c1d7174d61ccff6c07d734ac02e67e
SHA1 4883f248dd457ef82a6f7d4816cd24440e251da8
SHA512 02673373cef9efbdfc77aca657e17d3df7b3eab6611000960514f95e41096f2e331881299df2645c0aeafc48c051f490529aada347e963f4ac76c2849918234e
TLSH
T1E1F0622C1673480CA9892E72E87384C023009682C88031DFE70D026450D1FFA338069F
MD5 SHA1 SHA512 TLSH

Submit Download

9cbe24d9-fe73-413a-96a0-61e5a403486b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9cbe24d9-fe73-413a-96a0-61e5a403486b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9a757fd0169606cc3c10368563ea0ce56b1acb60a8b1dc3bf1468e513dc8971b
MD5 203ebf9c817def5b34bb74511c2efdc9
SHA1 7d3dbe490c7358de684545f31b65436dc82f7172
SHA512 52745f71004ba665e315c68699630ca12fbb20b5e65f21643ecd8456ec05c482fb2d69d0e6f291077fd9ffafa6249d38ac78e21f5c114a1d99b5317972156867
TLSH
T1C1412A58A6F91158B3B37F576BF6A86D487BB9372E4AC55E00010E4F0632B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\base_library.zip
Size 711KB
SHA256 87aa00aeadee10f0930e97db484c087641a7963a7073beb4bfba68bc839f9878
MD5 aaf9a6bcb2d4335999f67fdd3be9577d
SHA1 16a1b22c15f785785bfeb1d94d3378856d8722f2
SHA512 569990f03e8731524c8d53aee7c21be070216bf59661fd76b31bfdbe7a7f3b5c31dd1f69f19677751071506504afb6cab88001c9f711003d3144039a5c04a741
SSDEEP 12288:xk1wjfyEDoQDSpLyax+Q2osQNRs54PK4I1AV0c4hU7dYD:xnjfyEDoQDSpOsV2osQNRs54PK4I1AVi
TLSH
T125F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI30082\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8abq8ssj.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qdh7361l\8abq8ssj.exe
Size 5.4MB
SHA256 a9e4953499230f1f9327fb188da745dce49a78f42edc22744540d888cc2256ad
MD5 d209cadb650abc4073c02f500173a0e7
SHA1 36de3d472be0021d4880e09a6a25db5de1fba88a
SHA512 0d6fc49a40df01b4ec3f4ba663f756f7a02719da2db586ddd1778d0ba179cae6f6fd42af444963e1e60ea5257579b8b748ae2ca11c42e6eb3c9a312c2df0029a
SSDEEP 98304:yJgtdx2ICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllKH+ZMqr6n1K:Hdx2ICteErownP0oTcMsABqlqBn0
TLSH
T19B463308B3E809E1E9B3D13D85665221D473B4254BB0D5CF03AC9B662F777E0AE3AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-591-0x0000022D84460000-0x0000022D847AD000-memory.dmp

Download