6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0

Analysis

max time kernel
60s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
Size 5.4MB
Sample260821-p81mfseq61
SHA256 6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0
MD5 eac9348bad126ce0d76c688bd854dfb4
SHA1 dfb1b35176988d4af82e1fcd94134130ec5aa401
SHA512 594ec4335922eb3333732a961f0186c8694087d99904c619492f48950bcdc3c51dce1c2d8cfee144e4e9bf390485ebcf6534409eac8a49286dde312cb4fb1235
SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6tou:GiiICteErownP0oTcMsABqlAuct7
TLSH
T140463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1811
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9820
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1492
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8547
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7632

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uugemw.exe	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uugemw.exe	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe

Executes dropped EXE 2 IoCs

pid	Process
1812	tch6cuuj.exe
1844	tch6cuuj.exe

Loads dropped DLL 22 IoCs

pid	Process
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe
1844	tch6cuuj.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\an7e00kj\\tch6cuuj.exe"	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe

Looks up external IP address via web service 1 TTPs 53 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
111	ifconfig.me
222	ifconfig.me
299	ifconfig.me
353	ifconfig.me
402	ifconfig.me
439	ifconfig.me
476	ifconfig.me
522	ifconfig.me
71	ifconfig.me
193	ifconfig.me
234	ifconfig.me
624	ifconfig.me
808	ifconfig.me
990	ifconfig.me
1083	ifconfig.me
324	ifconfig.me
498	ifconfig.me
652	ifconfig.me
686	ifconfig.me
883	ifconfig.me
127	ifconfig.me
202	ifconfig.me
265	ifconfig.me
343	ifconfig.me
349	ifconfig.me
485	ifconfig.me
910	ifconfig.me
147	ifconfig.me
259	ifconfig.me
465	ifconfig.me
479	ifconfig.me
42	ifconfig.me
160	ifconfig.me
318	ifconfig.me
362	ifconfig.me
421	ifconfig.me
470	ifconfig.me
517	ifconfig.me
946	ifconfig.me
35	ifconfig.me
91	ifconfig.me
149	ifconfig.me
205	ifconfig.me
232	ifconfig.me
268	ifconfig.me
727	ifconfig.me
1017	ifconfig.me
128	ifconfig.me
293	ifconfig.me
377	ifconfig.me
419	ifconfig.me
435	ifconfig.me
442	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4236	cmd.exe
5352	cmd.exe
5704	cmd.exe
6624	cmd.exe
8844	cmd.exe
1744	cmd.exe
9336	cmd.exe
10800	cmd.exe
4412	cmd.exe
4308	cmd.exe
8304	cmd.exe
11812	cmd.exe
2284	cmd.exe
5504	cmd.exe
2852	cmd.exe
5376	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	msedge.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4344	3624	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe	86
PID 4344 wrote to memory of 2284	4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe	87
PID 2284 wrote to memory of 2104	2284	cmd.exe	135
PID 4344 wrote to memory of 2744	4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe	92
PID 1812 wrote to memory of 1844	1812	tch6cuuj.exe	93
PID 2744 wrote to memory of 2384	2744	msedge.exe	94
PID 1844 wrote to memory of 1744	1844	tch6cuuj.exe	95
PID 4344 wrote to memory of 4552	4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe	97
PID 4344 wrote to memory of 4128	4344	6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe	157
PID 2744 wrote to memory of 4684	2744	msedge.exe	99
PID 2744 wrote to memory of 856	2744	msedge.exe	100
PID 2744 wrote to memory of 856	2744	msedge.exe	100
PID 2744 wrote to memory of 856	2744	msedge.exe	100
PID 2744 wrote to memory of 4168	2744	msedge.exe	101
PID 2744 wrote to memory of 4168	2744	msedge.exe	101
PID 2744 wrote to memory of 644	2744	msedge.exe	102
PID 2744 wrote to memory of 1740	2744	msedge.exe	103
PID 2744 wrote to memory of 644	2744	msedge.exe	102
PID 2744 wrote to memory of 644	2744	msedge.exe	102
PID 2744 wrote to memory of 1740	2744	msedge.exe	103
PID 2744 wrote to memory of 1740	2744	msedge.exe	103
PID 1744 wrote to memory of 2008	1744	cmd.exe	104

Views/modifies file attributes 1 TTPs 15 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3808	attrib.exe
5572	attrib.exe
9064	attrib.exe
9904	attrib.exe
2008	attrib.exe
1248	attrib.exe
5288	attrib.exe
5452	attrib.exe
5372	attrib.exe
6688	attrib.exe
5464	attrib.exe
8444	attrib.exe
11104	attrib.exe
2104	attrib.exe
4328	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
"C:\Users\Admin\AppData\Local\Temp\6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe
  "C:\Users\Admin\AppData\Local\Temp\6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe"
      4⤵
      Views/modifies file attributes
      PID:2104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffe9dd1c188,0x7ffe9dd1c194,0x7ffe9dd1c1a0
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,1749586251638018461,2119717344430031218,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
      4⤵
      System Time Discovery
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,541727329447421057,7096085168811054757,262144 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,10733614138134276419,13267217006279720842,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4476012096918019714,1038171568280718716,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6496429637937190763,6631680112630427032,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8210574583129552722,18150706691330113395,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,17511718971288671836,11735080642293904377,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4596,i,7342228101609360109,17527689026230089560,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4888,i,18147039297476514330,16333015017924806209,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4588,i,1678926325280164068,6606507257130629472,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7656626111845682740,11967399095304519845,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9620862067177958609,7864708556991998992,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5896,i,10890561818145633449,8388224049065924632,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5920,i,14130280854810548082,7252182352305977254,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6256,i,2607220727679786411,15180431916177787916,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5676,i,13248453578102401310,13363851890854314420,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,1844416978495472360,16135815452453914092,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,16429354913290990822,4544987066300381406,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:8
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6596,i,18213602019578547159,15141082465936090500,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,1432242945717201380,16550445291277908844,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:8
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,1432242945717201380,16550445291277908844,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:8
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6616,i,5754786110770214049,15007199391007664217,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6776,i,17008396250446204465,4245527444820222896,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6792,i,13139338100700419427,4870190847656669521,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6840,i,8753101599301320716,6162222174814364170,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6724,i,15567275901174457312,3641959117285862056,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6772,i,4627241920613813387,16817187952100868586,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6920,i,9881205971363452356,3781890581899177912,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6964,i,14459368062412197632,4069630293098191306,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6996,i,12277223626669542347,7816405179515846184,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7128,i,8252327578494229357,4384832092536384487,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7108,i,10903923409334506534,18310854529138945322,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7240,i,5139995541208547815,8444892532442938002,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7212,i,7481250201389282349,14840214069671761832,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7256,i,11057774501604830429,11885903666232360539,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7076,i,11558090105518044660,13049633852256436697,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7288,i,5833540113228619684,2515675193979814181,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7304,i,17900593879984056145,5236094937648471378,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7344,i,4904129375367275566,14198513536462100887,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7356,i,432976986131364548,11454560844726380845,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7388,i,18380469282341779885,10183479603829845984,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7456,i,1341062299670388042,7207073239272273307,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7412,i,10020693359936533480,17959009830463270239,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7480,i,16809829077976781122,16080715389954910410,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7572,i,9073421961142406309,15303217862282020375,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7628,i,4948548161810095505,12959371513790176917,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5432,i,15355217693823294864,4882370190294911790,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9580 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5396,i,12220611992144086571,1429082730161198654,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9716 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7736,i,11552490584327287396,2358647768670982290,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9776 /prefetch:1
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7924,i,10179085966261238367,12740213132018224020,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9596 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=7964,i,1811352560685124511,17745240380063276487,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7972,i,1391276769936577688,7694339639476928136,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9752 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7700,i,16814452218193647911,9732606055952195351,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9724 /prefetch:1
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8004,i,1628660770553831430,475673467801698552,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9820 /prefetch:1
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=7992,i,4973367149338531020,6747856553642626113,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9828 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8044,i,17781980020938327432,12806335698804730600,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9864 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=4652,i,6488241432230759425,10095315568427884831,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8064,i,5731490435163031346,5194277020307588239,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10004 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=4704,i,2740362211667742860,7053259665377669454,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=9968 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8100,i,979451635138586845,10618073281677969705,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10024 /prefetch:1
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8220,i,6627789947952441698,8583528475889610281,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10080 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8536,i,16632986698895310247,10268297815680107090,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=8188,i,17628328038320814633,15806457287462849683,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10060 /prefetch:1
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=8300,i,10679884751616200759,1311003765107148130,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10172 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=8276,i,11158677501441876279,1344662634826528470,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10136 /prefetch:1
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8244,i,10218908226394796536,4858006769013911605,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=8492,i,10730681455364919880,11571511351582928198,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10228 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8656,i,4264218569912895897,9833724029980110735,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10380 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=8624,i,11974584917884677391,2126574260202593375,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10364 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8696,i,3122951394851045287,11635178836885004352,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10392 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=8636,i,8144293488542033226,9548228371991468469,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10368 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=8692,i,14422773042590071811,3585037459173407738,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10372 /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8760,i,9430598888097040846,15440959231155705195,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10592 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7040,i,6613211866166719876,8431699789255318939,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7008,i,14920895315180452153,13406475177622090446,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=4896,i,10249817310357315159,13675666213361049586,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8992,i,13008267853807817427,8897817407716166930,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=12452 /prefetch:8
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=10720,i,16459533904186465567,3019163269769525574,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=15976 /prefetch:1
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10748,i,16692455231706044404,6629291149097302246,524288 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=10684 /prefetch:8
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --metrics-shmem-handle=10832,i,3341907959338848051,15741030491821187644,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16008 /prefetch:1
      4⤵
      PID:6876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=10760,i,6473769407261991271,555373004266058504,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=15992 /prefetch:1
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --metrics-shmem-handle=10840,i,7770159651171621490,14659348666048362435,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16028 /prefetch:1
      4⤵
      PID:6892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=10908,i,3257191491418364478,1237705271476954560,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16040 /prefetch:1
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=10868,i,10484201531107772850,17470135695339938081,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16264 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=11060,i,15884217737509927057,2596295552406899725,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16236 /prefetch:1
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=11112,i,4031175285103484041,9148052088465787297,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16332 /prefetch:1
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=11116,i,3629684795384041662,13103148482461120716,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16344 /prefetch:1
      4⤵
      PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=10960,i,7041122953300671335,11967485475522668291,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16144 /prefetch:1
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=11148,i,11882032321304092460,4649723439898705002,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16364 /prefetch:1
      4⤵
      PID:6948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=11176,i,13685119343597721498,12843404271891341657,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16440 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=11208,i,15898374642315712817,10288653020987004934,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16388 /prefetch:1
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --always-read-main-dll --metrics-shmem-handle=11232,i,11013028396416395021,16077011855575813126,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16520 /prefetch:1
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=11260,i,228741567230526721,9007830823798535009,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16572 /prefetch:1
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=11292,i,4868830927131902390,2082202231069698279,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16620 /prefetch:1
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=11352,i,9506873645433645188,17176125930691811335,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16648 /prefetch:1
      4⤵
      PID:6996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=19116,i,6133257524183389270,14582965462361529970,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=19128 /prefetch:1
      4⤵
      PID:6780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=7036,i,4119316362847492121,2653091573468754401,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16428 /prefetch:1
      4⤵
      PID:8032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --metrics-shmem-handle=11148,i,3358645190699815221,883451986408438135,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=18972 /prefetch:1
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=19148,i,15276108543107542269,5570296389030872331,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=19332 /prefetch:1
      4⤵
      PID:8180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=18656,i,18325592554846167494,16355716473472782516,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=19372 /prefetch:1
      4⤵
      PID:7924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --always-read-main-dll --metrics-shmem-handle=4604,i,15349758928307459466,15448421274712769298,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=16432 /prefetch:1
      4⤵
      PID:8016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --always-read-main-dll --metrics-shmem-handle=11096,i,2993879411468924762,8100281637035751020,2097152 --field-trial-handle=2396,i,12661379108105927071,10330041754707405350,262144 --variations-seed-version --mojo-platform-channel-handle=19628 /prefetch:1
      4⤵
      PID:8344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3192

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe"
      4⤵
      Views/modifies file attributes
      PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe
1⤵
PID:4424
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yhk04oel\fi78uiqa.exe
  2⤵
  PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4236
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe"
      4⤵
      Views/modifies file attributes
      PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2268

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe
1⤵
PID:2640
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8or9i3xi\ly75a0ph.exe
  2⤵
  PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4412
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe"
      4⤵
      Views/modifies file attributes
      PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4888

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe
1⤵
PID:680
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uu3e162u\yq0jeovk.exe
  2⤵
  PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4308
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe"
      4⤵
      Views/modifies file attributes
      PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1⤵
PID:4128

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe
1⤵
PID:5320
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gz3mdadi\qg2qfpyk.exe
  2⤵
  PID:5396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5504
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe"
      4⤵
      Views/modifies file attributes
      PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6060

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe
1⤵
PID:5204
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uht15e5y\hher6rgj.exe
  2⤵
  PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe"
      4⤵
      Views/modifies file attributes
      PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5968

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe
1⤵
PID:6088
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il0o8peb\xrhjmijb.exe
  2⤵
  PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2852
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe"
      4⤵
      Views/modifies file attributes
      PID:5288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5920

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe
1⤵
PID:6060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zk1vfw3s\shkgp0fc.exe
  2⤵
  PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe"
      4⤵
      Views/modifies file attributes
      PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5484

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe
1⤵
PID:5864
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u58zxi7p\22031ix0.exe
  2⤵
  PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5704
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe"
      4⤵
      Views/modifies file attributes
      PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6376

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe
1⤵
PID:6468
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tt9ncqkp\d0qrefym.exe
  2⤵
  PID:6544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6624
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe"
      4⤵
      Views/modifies file attributes
      PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8124

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe
1⤵
PID:7900
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\auo6p6ht\m9crko2w.exe
  2⤵
  PID:8228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8304
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe"
      4⤵
      Views/modifies file attributes
      PID:8444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8632

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe
1⤵
PID:8732
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p527cz8p\npom5kqd.exe
  2⤵
  PID:8860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe"
      4⤵
      Views/modifies file attributes
      PID:9064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9424

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe
1⤵
PID:8924
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vg5vvgtp\qxecwr22.exe
  2⤵
  PID:9292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9336
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe"
      4⤵
      Views/modifies file attributes
      PID:9904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11596

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe
1⤵
PID:10496
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t6ubjmcc\r8oxzli8.exe
  2⤵
  PID:10732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:10800
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe"
      4⤵
      Views/modifies file attributes
      PID:11104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:11468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:11708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:11836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:11908

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe
1⤵
PID:11612
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ztkzriji\m8jdvxqp.exe
  2⤵
  PID:11776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5g31uets\2fzc918b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:11812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33d03a61-864f-448f-afc8-2293ec836ce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33d03a61-864f-448f-afc8-2293ec836ce4.tmp
Size 18KB
SHA256 ca4cc9952ff5e2c9278def5ffafd6a7a482b3f286a9a21ad4003c3fb0af1aaef
MD5 5cde49b17fa1aed5771039c7be9b93b4
SHA1 6bddd13f5795d2ba9ceaef0df14a647d52d1ec1f
SHA512 99d6103dfc25977065f33e4b3315f5f0082e78cfa3b90fc75ec418b439b0c0bd506c03a982808be107dabe0abf837e3288215e7fab74139717e36d2da9329596
SSDEEP 384:nUdZcIwsNal48mLEa+qOfZRUqCivF3Roe:UFwuwafORRU3iNhd
TLSH
T186827D306D7CDC7218EAE245F5863A575FF850B789C9AF98D4D99F2C00D7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 282KB
SHA256 51e850c34c6234bfc2398bb758ea65a0a7436581ec068e7e47ba5e6caa482c95
MD5 f88654445271c1eb4deb64610eeaf703
SHA1 070b6547efae9b83885d01a4189b3915aff96d23
SHA512 977734f52640a632136e66efbdf9e56d9202deebe752b8cc033623f4ca10d21fa8208e3b1d12154e4284ae2881c007a9fed655902df2caedc7de64b74dd68a2b
SSDEEP 6144:uzaJQehk3mfKzVLixCOix18atTGTYen5/o5XlSn1Ew:U3mCpH1BTGzsXlSn1V
TLSH
T1115423149B4D02116BF9C02A2B5A4949DF89648DC0850DF6F8EA3E27DD00BBE0AE75FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 214KB
SHA256 07f3fb30bfcb328f5548e84b68053ff614bd48fe0d034996c12d85f45a6a8ca3
MD5 14fb8d393c3510553333f65847e57f08
SHA1 90dfec3e518fe36387a0f1b68831e9cafd1b53e4
SHA512 b76fd8171f32d00352609668ad160a62ddd76f16510546c444d9194d7302de726031809f5e8bcd5d86dd6e3bdef4209a051f5767ceb26b648765f78604f02f75
SSDEEP 6144:kSobZtyoq8Jd1ImfyY4ahX8T1s6eg2PRlak6yd8I:hgJd+mfX4cy17wpdd
TLSH
T10624234E38037C93B5517EA20DEAD951E267EF99261FD7946613802DD33703EE4BACA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 151KB
SHA256 0555e65407a45302d001a7c4192d91470c9dea2c89718f1849316f801109ac48
MD5 eaced7fedb99c1b4ffea21ccb5c29e2d
SHA1 7759f0abdc19164e96c4c6c074ce50c73c31654b
SHA512 3d91a030019c4c0dbfc6fb3846b914fc8eb7eee4d411065bd6f546b170e336e3630556aaf9ecc378e7837862244bae36483d160b6e087a314c2147606604fc43
SSDEEP 3072:54+S6jl1vXrTSsZM9LbcvUnteOpsPNt34GP+9qOQdKWcTjXC0mt8ZCLhfTzy6Ca0:5g6JDk3ZgtOUOiK1TbCLVxdCa7Vbpn9e
TLSH
T19CE31260E69C72D4EB99E7C04F621B38D64C4534C7360029AAFA7F9CE4D6E2BB64503D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 219KB
SHA256 bd194f912c80cb84f75de607989587ecaf5cf3886a2af3556640765150e727be
MD5 8a3e7dfd05c97daeb1c687c6656f5016
SHA1 cbe1d15be57427719f5afe854a0949e959e74cb1
SHA512 630b13a6c868e6769c35d465a7781b58cdc3c3d3a2a3e6a688a197a925b6e6de3ecac39afc9aa47c27192e1c437fe00778eb0d0588ceb85ca2b0e386d1b95227
SSDEEP 3072:3bz9barNmHnBtA4Xb7fgyWuF6GUwX+vwdfsFOGeWesUSKNb+yts0A76Yyw:rzsBk1bgo6GU23u5esPY+d0I
TLSH
T1BD2422D04D270BFF82B6037BCB187D9E7F6F42244A573F249A81D98BD50A30A74921A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 89KB
SHA256 e61213e0c958dca27e7a1ba05433e5f867a181ca723821f359b62e2608aaea29
MD5 206159c33f739cd6f16dbd7bd1d947a4
SHA1 4b5e15a9dc95a849fd9b5832d69e4e440194c1ff
SHA512 d2bc7ceb80bcf3136dec0bc5ba7b2bbec42f06fedfb5fbe5bc6fb830c1701164823d1d4497da700481ca6545bc3cff7b4172dff8a44aab24d4b35e87cea8b93f
SSDEEP 1536:7rBVOBa4OrL9/i159g0O4K6Ko7mvkUfVx6SiJTMGrB87D29bzzP6pbySyd1h+0wh:uA4OrR/iZi9hoqfVxEJIGy/21zzDSaN+
TLSH
T1D39312679803357B2BC0856A24D5CF052CEBB7B6413A13BAE63C85C3B912FD5D61AA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 47KB
SHA256 53977bfb2ac015dea4764d0bc4e9083664e9f24891f9c980999f27c5f3aea8ae
MD5 1d983683a5ade8b330dfc9aca29a9369
SHA1 58f93d18f74734052664fe877382465e944678f0
SHA512 c95130abc0bcb06b8d3651eb7eafb76f0aa56928e6605754e27b3336166b4407877e41c20c3f2f3ba477c5d564fbd0392aa3c67dc953495bbf3eb08e30b5d613
SSDEEP 768:Fr8ZxwH4wUt9nRVyHgTUOjFnLVUNvSt8vPV7G+R8dbpPE69ScGW+Torv2u8:yxy69RVmYlBnqNDvPV7vR8XE69ScGRTH
TLSH
T1582301162C3977A25171BFC5D272024375EC888EB63ADD8F4C61EA442BE8CA361DC735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 67KB
SHA256 aeae0da73139a235146c7e1a5605a969b0bed0743c2c06a272ee818329f48cc6
MD5 1a3e207eb153670f2c2385982d8a51e8
SHA1 d3b43669f9a94159bd9b8bb3a84efb6f6a02443c
SHA512 9cf1048da74f382aa5e40c4ea9cc2e6db854603745820687bde686b8d0e4dff59620a48f4f8d4a7d7dc664b0ab9e35e0691af306f238601ec3220c9ffcbff33b
SSDEEP 1536:yWor/EUuvPCdgVVidBZm9sxZUezwC77Tl:sr/EUuvRoSsx3MC77Tl
TLSH
T1CC6302A501357053D84F5ABECAC71B5E0CCD9975B0A9C6CBA59D29A33C3887874EABC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 105KB
SHA256 7b8d112484417a8d42fdabddf05f0290fccd408ae60ff5dfb31e3f20ff2efa78
MD5 b178e1f5ff1914fe6b4a359250094563
SHA1 7ee2cd48c0ad2bbc95562fcba04fd5bf27b2c8ea
SHA512 9917a66702effcbc7a8ae72cc2c061a4133a3537c8e72f6d672b3853c5089f10b359ce1f81697b2f6166c34bd10f07a284fec4fe47cafd09cc3415d8d4bd9049
SSDEEP 1536:wmZgChsCj7xp1R3qbjLAscyIpgtVfptHcDJXmNBYYDWsSj15d1zKQzkGlj8JJk9K:wmtxb6fwypTtH6OBzS5lDRKWg3
TLSH
T1D4B312FBA50CF7C892D95CCC28BFBF64332EA9294C5381DE59A5807E224E9DD0543963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 38KB
SHA256 4b3e6dfa074a5df45ed36540be3268d97e7a12da51eada5347845bec18607f28
MD5 4ab7eb683a7a714de85fe83a4d6b8a38
SHA1 79b2569e774f7d42a7081f2f538851ab2eb39b1c
SHA512 1da854125cdae70a6eb51ebf39972417953e6f2d97a7215e789c9ae018ad8c208d857190e0ecd1268cc760962fc271392b4ff127ba669e89f0e437331758d84b
SSDEEP 768:weRCGzrSeJ7Ml8eL94fs7TkaBLv/UuVdw7ApGw1kgSLtgQJzXH3iKMSS5:TCGzrSeJ79eSf4dBjUgGw1kgSmQx/45
TLSH
T1CE03E1583F9EB91AB7A68081A3AD4FDC49ABD4817775DA8D02E410F9C051DD3C936291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 93fe5e3a0afb9d38c717959d8468b6be04c0439b7574e219641c470a63056967
MD5 8435a385c67641e3b04af89ee1d443ad
SHA1 3cfd0dda79dd0a614687a5b0e3f87d787b49bae2
SHA512 8209319019f952e2a1f40f3f2612b00410fef1d0adf097ae199bf81146f70650c081de2d84102f1a0d79eee0560e04254931c6e20c8166dbd5e84ffd0115b817
SSDEEP 192:sxZdRYyM/jK1Ml8Mjy/f0s4JFEdpLB8SF0/W6+WNi9mlY/99mfYBZ/rKEIgyJ:sxZd67y/f0s4Jud8bb6yfe7O
TLSH
T11152E816BB3859778CDBD219F951BB57D2F5046292944E48AEFCCE1C00E7AEC224781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 28e7fdbad687af767265c23f96f3a9e65113ff9965f741228bb4c9a7109d3433
MD5 f5020bc0395a5913c6c773ab320c6da6
SHA1 9b6e8be76fcb97606518eb91394c37092800ccf1
SHA512 ff35431c48d1a874ae9db32dab4d44141cf24690afc4d8e17bfa278e4a8db6005ea00f3f25d5a6794519ae33871dbfe167d5bab28ba91e8a1441786a354344be
SSDEEP 192:sxZdRYyM/jK1Ml8Mjy/f0sRTpEdpL4XSqJzF0/W6+WNir/r20dvIJPsfYBoZkXrJ:sxZdy7y/f0sRTiI8bYZ6+fE7N
TLSH
T1A062D7127B385A778CDBE115F554FB17D6F50462D2904E48AAFCCE1C04E7AED224781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 526e54d582f623a0d5219ee9bdf64cc9ec40d4eed5585b39b00c6c8dfdb57bc4
MD5 1504f7344094e440b33c087804fdfc05
SHA1 1da791fdf03fdda26b7896c247440d4ba6925348
SHA512 61a9ba8b5b24c3a699df72a3f0ca4edca3b45680372019938e74b314f899c0c82cbe80ca8bcc3f9bc52a303295f555c301ad52398905ea042fc3d88096343008
SSDEEP 768:gx8bqC+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OV7ZLlRTKV3roon3:gx8bqC+WvSCt6u1jacZLbWVky3
TLSH
T156E20B3B280CCB7E4F845E5DDC26AF966ED801CB5B988D4447FA884C03C76EA512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7637718f28943a7a692b381c1eaddfe4afeebdae1e5db12dfe9c73b99b29cf3b
MD5 2aea28af082a4c4a2bab66f75f34f31c
SHA1 45e12343b746d44c8b0aed24a18a20dbc7cf0f6e
SHA512 2d65bc75aa8d2b3b6751daf94afe78598cc9e188811ba4cba75d8cb038f03df536bc8e18a6609feb7597b5b97a3c118ee466ca1e49ecf97443b15410177838bc
SSDEEP 48:K4aIfK3qAry1/IxKkY87yB4InK52EWQtsAOyz:K4aUK3qGm/KKkYii4QK52y
TLSH
T1C1912A2732B7024138BD250DA2D996779E4931633428A56F7BF860F15F6AE216CFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4191190545ce904035752bb070f39b26d445334d2abdb503c9dff0bcc9052d82
MD5 390339825fdb91f1f25f576f0f5239af
SHA1 5e1aa9be7e974184d45761479c5f46691cc7e55d
SHA512 a60f3ce05d4f065f210a0a838f6dd0b9bba655f82720264f98be4ada5d50ca767436aae3bfff80f8dbb571dd4c6b86767379e7d8632fed360c68e5d60dad911e
SSDEEP 384:nHEZcIJAsNaI4K/hEa+qOfZwUqCivF3Roe:HiSYKafORwU3iNhd
TLSH
T1F8927C306D7CDC7218EAE144F5863A5B9FF850B799C9AF98D5DD9F1C00C7698230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bcb3821d485b89723bd3e7781d05f8cddb1255cb46c55a2870cc9107354c688c
MD5 98c37306d8e9f828abcaacd6ebf3e703
SHA1 cee864e60da31ca78f340b61080d7f39207708d2
SHA512 53ad42aec8783f122c12fbc18e5384c15520e63fdd70e4a22ae507f842f25b74656fdee8798d7ff68c0daa4628e0c6bd503273fa56d0e0d2d0ef2dd5e0e12198
SSDEEP 192:vONI6Db6QmiUyZBHBa+jeOmEtm8RgqZdDU6:vONI6uOHBa+qOfWUNU6
TLSH
T12B02E83569386CB79EA2AE49F4873B275FE4203BD9566F84DAD81F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5e135b63907afd1e215e505ce2f64a4195809c58289fcce0246a17fb18c76720
MD5 593cd214c6b9032332f970ff1b97de9f
SHA1 31b3f0c6136d03b32248cb2a1f536b0bc303947f
SHA512 8935eb135ec3b5d6a10761ec7e134f1cf8d7cce55845717288889636eade63e26330c9b1f591adfe3a1a61d7467b272c556d7736dc7aa0821d963833ba31965a
SSDEEP 192:zU8sNa8QZ4biHrQmiU1FXzyEa+jeOmEtmy8UNmqZHqjlC9YyXj/3MF:zU8sNa849jeEa+qOfZ0UqC5Tk
TLSH
T177422A3579789C728DE6A249F48B3B679EF850B788856F98E5D94F1C00C729C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ec79e42dcbdd26b0c50c96e2e2ff2cc6f75fa80354537513c06902654a0eeda2
MD5 bf2bd5a0f5cb7917ee9a81b88f86ffd4
SHA1 de661c6810b7e7d7d074bb3c183d086c000d699b
SHA512 16fa989b83ebc4b227635122f7b862d5a0e778e4c3e72cbd5ff7f9f42e83641f425885c0a1a8233af8a9a257754e136fecdc3d7f317c949ac5953b4b24c9a04b
SSDEEP 192:zU7sNaBQZ4biHrQmiU1QXE1Ea+jeOmEtmy8UNmqZHqjlC9YyXj/3MU:zU7sNaB496CEa+qOfZ0UqC5TV
TLSH
T1BB4219357978DC729CE6A249F84B37579EF850BB88856F98E5D94F1C00C739C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c8ab96ba98bd09d893d4a836cd91321fe54a146bd889cb7bd8bcc89aaed7f884
MD5 8704099f8acba30c4ff5af984917f3ad
SHA1 542eb23df54227fa2ffd65d9d9c494cfbed58aff
SHA512 b0c2d65ae319460f394fd62bf805abe428a7966e4a4d1ab54f65e131cf8dd58172640d369dba714f11b1cea104624a8a14164a39eaab2ad8630af117df567203
SSDEEP 192:zU8sNaYQZ4biH+QmiU1MXhgEa+jeOmEtmy8mNmqZHqjlC9YyXj/3Mb:zU8sNaY4aeyEa+qOfZoUqC5TC
TLSH
T127421A357978DC725CE6A249F88B37539EF850B788856F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0c9ce7e246ec904220bfe06a714c33505aea0d6774e26b25035d11fb97e8fb85
MD5 ffead97e028afd5d12eae282b099b325
SHA1 52b70f91a49fb0ad4aeacac076727241600080bf
SHA512 6e5e7c509879a9c918b05f96692570cab427c31ac35e3b4f2ccb1ac521dcd35e5fb72e4742c9e7e4d1f7cb0f565325c42a1d8aeaeca6a3d993aeafe7a8caf01d
SSDEEP 192:zU+TsNaYQZ4biHjQmiU1+X/OEa+jeOmEtmy8mNmqZHqjlC9YyXj/3Mb:zUEsNaY41AWEa+qOfZoUqC5TC
TLSH
T1C8421A357978DC725CE6A249F88B37539EF850BB88856F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7906801abf6fa4d5c8a948ff9a0052b649ccdf15037a0e8d3dec7bf862019bfe
MD5 bff14cecae034dd8d90207133b20a126
SHA1 60f0f1e29ff0b2c175f679c11683e5cf3e5e61b5
SHA512 0fe6e94434003f0a81db5d998bd87a45fa1c2d5aed18ef78d5721f3f8c1183c7ef09d315a85ed15af4044e84c3f70e6698aa64308d93c4329c805bfdea87a7f1
SSDEEP 192:zU+7sNaYQZ4biHhQmiU1NXNyEa+jeOmEtmy8mNmqZHqjlC9YyXj/3Mb:zUUsNaY4fjAEa+qOfZoUqC5TC
TLSH
T1DC42193569789C725CE6A249F48B3B639EF810BB88856F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6939ad3260c6cbb24ad8cee8473038caa5978e5f09207658a51316b132c93873
MD5 3413571b95a5ae1e3edcb69910c3aeb2
SHA1 dc8dd9f740e7691632dc67bf46c2fc43f3f00c30
SHA512 bd17c595eaa2987a4714a1dcced092222375591c9507cac02361b3b4ee98918b1a8371aafa999e6664f69ff44eb374cfaec03632037109d47813c7344f92e6de
SSDEEP 192:zU+psNaYQZ4biHhQmiU1DXhbEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:zUSsNaY4flZEa+qOfZRUqC5TC
TLSH
T1494219356978DC725CE6A249F48B37639EF820BB88856F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c68eedfc4df40d5cebadcd01ff7326e5db43c777442d7da373e945f9f808a02d
MD5 082fcf7514ed45775471e0575d40e8dc
SHA1 e322850ffb31dce64425c47b0925566052680558
SHA512 98363b158673c8e61f656eb75f3b3e83ece003679e6baf9a46126f0bf8ed08b0af27ddc7cb23b5ac4c9a7c003f6f49c06f0e91bf2cf438ecf47e99b32b82cb72
SSDEEP 192:uuU+5sNaBQZ4biHZQmiU1eXYuEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUWsNaB4XgfEa+qOfZRUqC5TC
TLSH
T1A6422935697C9C724DE6A249F84B3B639EF810BB89C56F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 495616eea152882dfc8b2abf33d8a65f93e0229d9a9d1c15f32f2ea8d387f885
MD5 467a1f221bb954223ce8c5e2c9920dea
SHA1 e7fcc76ce9333d706485978ec39b50606e565053
SHA512 7c5bdbe1ee149446021cdc76ba80a2ca267d202fbcedc737df8357ac154a0c93d89095da659b576d9b98638067283a36990bbda6b7fada9710dc4510fdbe5703
SSDEEP 192:uuU+5sNaBQZ4biHwQmiU1rX3hEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUWsNaB4QZREa+qOfZRUqC5TC
TLSH
T105422935697C9C724DE6A249F84B3B639EF810BB89C56F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a5205818e042c26b8439ee7c38e92681e76c4399ec84368840f50f1d6c39b28a
MD5 2232ee324ae5ce3438a5fe9658931eb1
SHA1 caad32be2614e7c106b95950f51522dc208949ac
SHA512 e7123eddcfb9c0c67a4e10a92b2a2a9523cfc4d86a2978a4965f0e2bcb92c86571de4adaaa8d2e58893ce8c68acdd09b4164199b9ad5ec74098a2cadd7f0fb94
SSDEEP 192:uuU+QsNaDZQZ4biHwQmiU1PXwstEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUTsNal4QtwMEa+qOfZRUqC5TC
TLSH
T190423935697C9C724DE6A248F84B3B639EF810BB89C56F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 dfb69287ce5bbc74fa9dd28381ca30dc1940b014031653f139f1b43c82369958
MD5 3219aa30280a723a2bb37870e4bf0036
SHA1 65d203710c3b45a97156f6dd45089424b1babe35
SHA512 488087d1dc0c347bf587468bd12aaa6529d9677d483b6f126fd033dffa2b4f0f227a3e29f87c28c0ff4cb6e811c532db486327df6de03c47c36265971bef94fd
SSDEEP 192:uuU+jsNaDZQZ4biHaQmiU1BXDtEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUEsNal427BEa+qOfZRUqC5TC
TLSH
T10A423935697C9C725DE6A248F84B3B639EF810BB89C56F98E5D94F0C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 61d49c901523777b790cb768e045ebebafe8045578e4a25e2258fe113c7b6fa6
MD5 bb4f41fce099f38378889a75ada175ab
SHA1 620195c85af1e0c3aa1d583faa09c284eb70b456
SHA512 2364002143c436a8017793d7ede69dfd504930b4afa7e250270faa766c2186489dd98486a7f6301b86573d80bbdc08a7092f42780775d48d0d39d74463182ab7
SSDEEP 384:nUdZcIrsNal4+eLEa+qOfZRUqCivF3Roe:UFrswafORRU3iNhd
TLSH
T156827D306D7CDC7218EAE245F5863A575FF850B789C9AF98E4D99F2C00C7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1c9ea3f1fe2cede3c026cea22b1a4e95e379a905beb5688b48813c5c58465e2d
MD5 72c2594a457426ed8f6c4ec1ed757785
SHA1 c7949b02a704f9a9b73c15cbf0c79d71ade33221
SHA512 a1720191a7f5205982f7e00dc36d2225122fb888bd8a57e9cbe20278c082e4bb847c6a53f5b3c4da38e69225b6694fadf3c2fe0512673d2987730a245da26a02
SSDEEP 384:nUdZcIZsNal4dBlEa+qOfZRUqCivF3Roe:UFZQmafORRU3iNhd
TLSH
T1F3827D306D7CDC7218EAE245F5463A675FF850B789C9AF98D4D99F2C00D7698230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c952a70b0f4651526a70c8c58fe07d78dae31e0e9a7600f7b800d060c0db6c30
MD5 615c65bca3a676d563edf410f273d0d6
SHA1 5f96f6790a6332d3fbb07085054df32f5b371b6d
SHA512 5542a8f63aa073b0fd3a3a7d9a40f6af46ba28cb2426cc7c1ad10448c0dc6c04d5a7c960f3bb003d7defbdf6c0240503e22eca0fb26dac6af05b6a052a387e4b
SSDEEP 384:nUdZcIBsNal4CX9Ea+qOfZRUqCivF3Roe:UFBRuafORRU3iNhd
TLSH
T190827D306D7CDC7218EAE245F5463A675FF850B789C9AF98E4D99F2C00C7698231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f3aacab9ae2d9ff081e055d323c6e2dc6f640eb92b0568d3754e2bf2a74bcd1f
MD5 ad4320d7e5e2962d1a6ae0f03c7ac959
SHA1 a2be9e343e92037e6de8ffb676b8887a54112bfc
SHA512 40554a951af01754415f8a9b35fc503ffd7d36f0fd55d14ff8a3af482c84ce455a39c39b0ddd7c7bc3bf6db16337a4eb31a3b5e699231b7a33fb1993a5e819f9
SSDEEP 384:nUdZcIFsNal4ClvEa+qOfZRUqCivF3Roe:UFFvcafORRU3iNhd
TLSH
T193827D306D7CDC7218EAE245F5863A575FF850B789C9AF98D4DD9F2C00C7698231AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4c538ecf2d455f21e8cc89717a92f2559c56afc57492d281d6933105ea273eac
MD5 7e5dd53e5024a7003099fc3bd81b9def
SHA1 7a79949f9387d1f2b5977cb9ffe73e3fa19746e2
SHA512 4a3c6b3cf3479bfea076c90b29ea7cdc94fa1d98436c6b61273972c4233ccc43b819011f4db4faa5d12ea723a9a6363f7ecad32fd2512d3b2cd4eb0f0e67485f
SSDEEP 384:nHLZcIdsNak4HiLEa+qOfZRUqCivF3Roe:HTdmwafORRU3iNhd
TLSH
T192927C306D7CDC7218EAE245F5463A579FF850B789C9AF98D5D99F2C00C7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5c712571fe5b54610c1565da13b5109fe1ed276596935d7fc41c712edb79eb77
MD5 1ab45beba24a95331e4f14a5b1f8a143
SHA1 78cb545f85aa1259764a670d35e13d7a952f9db5
SHA512 91701e9bfbe2f3fd893f5058f17dbc33c4fda36aa396548a4e6bbb3b95d9c53fd81b83ae08ca3b270ea4da8924cd0220461c041096cf0c28bd22db68c96eb675
SSDEEP 192:uuU+jsNaDZQZ4biHiQmiU18XU6Ea+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUEsNal4+S7Ea+qOfZRUqC5TC
TLSH
T118423935697C9C724DE6A248F88B3B639EF810BB89C56F98E5D94F0C00C739C234AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a927497e02cc2363d8fe09c859ba9ce2a621e053d6be78b80a69ea068add7a9
MD5 cf5d2e3fa5bad041bdbe2163795a9c97
SHA1 486f39e1f869d8a92825f01d1c34b46598c0d2ce
SHA512 b12b46ec4b802248299e6b598965b7f803852a48d17b4873e8902db23d0188654cc27f2a27bb75965bc3965ec171149db4bab73f63f4972f75d188c44cccc08d
SSDEEP 192:0OND6DboQmiUyZBFBa+jeOmEtmy8UNzqZHqjlCU6:0OND6gCFBa+qOfZlUqCU6
TLSH
T183120835797C9C675DE2A548F48737679EE82077DC86AF88E6D81F1C00C764C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 4060278c93853a3c8e5ffd5ac8973b226ba3ec12e965c06c49947f53ecf3b5fd
MD5 20465192c347fbe35b01284b399d67bd
SHA1 41e8ab57ad4f36f5dc842907faf43b58558307ff
SHA512 9037625ea731644cea204bb3d53f62a56cb42f16ec088ae9e559ae742316ac2421d1a97d026f2eaee43d9e297528777dffdf462012c5d0fddd5c83df534cfa4c
SSDEEP 192:zU8sNaYQZ4biHjQmiU1RXSrEa+jeOmEtmy8mNmqZHqjlC9YyXj/3Mb:zU8sNaY41HGEa+qOfZoUqC5TC
TLSH
T15C421A357978DC725CE6A249F48B37539EF850B788856F98E5D94F1C00C739C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 54fa3d5e3ee935911c3ebe4e275f801bd6efe684f1ceeeb585e405734d6dcca3
MD5 884dd9e671db08af39e783cdb35452e3
SHA1 60a2b1b8a6fce1b1c70f45515565c646df20f373
SHA512 28b47a862fa4d02749ea8010d1df03ff933e553b67ab9caa21738156def6970ae0bc88eca3fa1e1f7baeb9ec482aa04a6ac329f05e936f5e8a46206718363ce6
SSDEEP 192:uuU+5sNaDZQZ4biHwQmiU1iXU6Ea+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUWsNal4Q03Ea+qOfZRUqC5TC
TLSH
T154423935697C9C724DE6A248F84B3B639EF810BB89C56F98E5D94F1C00C739C234AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a7884b3066f06aff68874532de8978eda0a2c789fb8de6cd3882e0e053a3c972
MD5 26b0857420c2c19035438548aae396e4
SHA1 548511178145b6134355795e1dbd19318c493b33
SHA512 5d2b28cffc0dd6ca72f1aa146c311eca29de3505ff0da61d823cbb3fb13fea42d0eb6e58bad39b6a7df396084a760886ba8511c30c042b4ed855b68672243157
SSDEEP 384:nHdZcI5sNak4PNxEa+qOfZRUqCivF3Roe:HF5h6afORRU3iNhd
TLSH
T15E827D306D7CDC7218EAE245F9863A579FF850B799C9AF58D4D99F2C00C7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3627d40e7bdb64afa4246092b72c19c5785cd83b5972cfa4291848020f51f4f6
MD5 7f6139b77eadb463ec560ea778981bec
SHA1 899f7ed827cc5c3d98d9d7bddda7f8b30472c0bc
SHA512 dd7bdd88f52f0694196793e01bd018b9d9ea0ebae628fd82a6eafc0f2402d12690776d8b3b36dabbfeb10221d7b63335f508534e554c16a3368c48cf89aa280b
SSDEEP 192:zU8ONa6DbiHPQmiU1rX48UEa+jeOmEtmy8UNmqZHqjlCU8:zU8ONa66xR4HEa+qOfZ0UqCU8
TLSH
T13122F735797C9C675DE6A188F48737639EE82077DC866F88E6D85F1C00C768C234A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c08757c9ee218396e94bbfb5513e3789f8ba717da63f1ef07ffe38efef7c7b2b
MD5 a7f82cfa89264a3f76329249c5b11862
SHA1 2871bdbeed3aba5d2c5e4eaa7248959764d2f666
SHA512 02c809b76a89804b67812f4225c9e3c9b0de500d6d59fee262dd4dff73f48fb237ed2734067d3faaa1b684a8e8e00ad0853be674962cffcde661235bdb8522f7
SSDEEP 192:zU++sNaYQZ4biHlQmiU1XXV3Ea+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:zU1sNaY4jBREa+qOfZRUqC5TC
TLSH
T1FB422A356978DC725CE6A249F48B3B639EF810BB88C56F98E5D94F1D00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ad54bc4f435ca45af48438dbbc5faec945e75f3d168c22d982fb00d86ec2b426
MD5 88fad0fd511dad0964df59aa61f6ad4c
SHA1 6d2d71b9705286714cbd82e1baf521a243291eb6
SHA512 ccf22a3393332425f9e15000f2baa76325ec5ea4dcb3a04a9658215785c60f254d51112dd1bc93bca8253ae3b4934978ff10bec422d66ce41d0f1f1ffecd7de6
SSDEEP 192:zU+7sNaYQZ4biHjQmiU14Xu1Ea+jeOmEtmy8mNmqZHqjlC9YyXj/3Mb:zUUsNaY416WEa+qOfZoUqC5TC
TLSH
T101421A357978DC725CE6A249F88B37539EF810B788856F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 d7227ac970f8fc99588e210926966d48ca9ac4323b476927391f31ee4b1679d1
MD5 5eeaa43078e2658067a9b2817ef88df8
SHA1 230eaa452380e7ce4bd37fda87ccb820d3962e57
SHA512 76410b5f6987dc4e2ea632f718ecde323dddc3fa77d952f05a60db61c0736cc5a94c7195aa86b140b7d6d71a7bf75489109cfbc5127610862c1b1bae3c253b81
SSDEEP 192:uuU+QsNaDZQZ4biHaQmiU19XiUEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUTsNal42/LEa+qOfZRUqC5TC
TLSH
T114423935697C9C724DE6A248F84B3B639EF810BB89C56F98E5D94F1C00C739C234AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 365d727a5ce1891e517a9bacfc4c2744ed7cf0743dc86f1f6fcc4853956c8aa9
MD5 6b1a4aa5787b3a213bfa283b2ebbcc69
SHA1 97ce266cd9a5fc29adea4e67c71fb964016341d5
SHA512 b41e3405f5fb9ed13e91fa61c55714be08f411d76a1e8ee15a66678812d293200fde7bd380121815ad75707e02b863e83727fde5e3728cfd284b1dbb15bf2a08
SSDEEP 384:nUdZcIxsNal4+N1Ea+qOfZRUqCivF3Roe:UFxPWafORRU3iNhd
TLSH
T104827D306D7CDC7218EAE245F5863A575FF850B789C9AF98E4D99F2C00D7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 097bf54e1b825da259b599f73971299b2c0690ea735e79ec96cca04c93aeec84
MD5 07d0b44c738489e043fdf49e0532a798
SHA1 83a04068fc39481509f5a9e2d9c43fed1ea92a45
SHA512 5a33696818ac6b9ecc22c2f313cb5d3e04e4ef4dd319db55b63a7e2877805c40775896b6d9ef8333cbd316e22394fbda622be538384fe1c44b976623d7a59037
SSDEEP 384:nHdZcIDsNak4CJZEa+qOfZRUqCivF3Roe:HFDuyafORRU3iNhd
TLSH
T1F3827D706D7C9C7218EAE245F5863A575FF850B789C9AF98D4D99F2C00C7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ba4bf3dfea094074dcd7b666ab5ee8e9db3b6b0ffc48bb278f6d6713dbb777bb
MD5 e60ceaea7198d99fe12223596f5a3fcc
SHA1 f49a8a1ff7d7a1f2be5a2b4963adcb325394db3e
SHA512 0504d584e48ac556f8ecd531c6fdbe9f7a8b2881ad1403e19b407945f7143cd87ec5f26f3aa4a51df4b625b4873b4652a25e15fc4d3ad8eea7c1ff4db56e6a17
SSDEEP 384:nHEZcIdsNaI4K2FEa+qOfZwUqCivF3Roe:Hid5GafORwU3iNhd
TLSH
T14E927C706D7C9C7218AAE245F5463A5B9FF850B789C9AF98D5DD8F2C00C7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 dca6c67632e6849576f3e6bee2940de9dfdf5ea300fdab3341660512d1f4fc3d
MD5 e857a2d76e737caa1b10d4cf86b395c5
SHA1 dbe19fd10d778511ba8bba63496005aa5e6dbb0c
SHA512 61ca88697db3731aebcf499d438cde67866d3a25d04d26f3f4deaca0db0212d91951b691b5b5eb629725503d3ee943046cb8f695f9fdfae415b319cd24a7843b
SSDEEP 192:zU+psNaYQZ4biHlQmiU12XSoEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:zUSsNaY4jMLEa+qOfZRUqC5TC
TLSH
T15A4229356978DC725CE6A249F44B37639EF810BB88856F98E5D94F1C00C739C234A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 682476e837729e0a81ce4e70bc52648d26339f35a24cff6c247cc0ebd3554219
MD5 9f2ffd7e8db2820669ede7d5aaeab72d
SHA1 0d9617851e31e4be82e98a9dadd2fc3d974b005c
SHA512 8811a7ac5056247c4f1f6653f2cbd17019b06ef24e823117ef992e2df20cc7bfd4eb9fb29237983b82104e5c49454589378ad3c41ae37b9942df2c7587dc9fd9
SSDEEP 384:nHdZcIqsNak4CeTEa+qOfZRUqCivF3Roe:HFqZoafORRU3iNhd
TLSH
T1AC827D306D7C9C7318EAE245F5463A575FF850B789C9AF98D4D99F2C00D7698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c177489abbcc6813cd67dcf7d08b9c7693f0759a0e0a306fb948eb7a806be268
MD5 d361ccf7f629375a5de358c81a3d63b7
SHA1 e317e2872e9b25979cb8b881aae18374cb5e8617
SHA512 de551867538141622f05758c4aea64453781a72ff0dce527ed077edc20ba7386d6dae9e8d6c49b66b3f9eb14fa064fc83055fe3d37d1eb758c3c07e4ed874f2b
SSDEEP 192:uuU+WsNaBQZ4biHZQmiU1YXZTEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:nUxsNaB4Xa5Ea+qOfZRUqC5TC
TLSH
T18742283569789C724DE6A249F84B37539EF810BB89C56F98E5D94F1C00C739C234AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 592ef7f1966d68b16cacfa3e4fce34b4e4717b60b0b65aa412bddd932a0ddf0d
MD5 43f7498745eaa0b233a1fc5ccbf6b985
SHA1 d9f92b582ec2042585c4ead12d3deebe3b0fa732
SHA512 e4e96d3a19fe660a0684700ad69e65bbbdb9b7bdedeed4004f2b94a5689e27034a551b54fa375c6a8e71e736abee1cc929f762cb15a0761cacb08e41ec479324
SSDEEP 192:zU+WsNaBQZ4biHZQmiU1qX2kEa+jeOmEtmy8mamqZHqjlC9YyXj/3Mb:zUxsNaB4XozEa+qOfZRUqC5TC
TLSH
T1F2421835697C9C724DE6A249F84B37539EF810B789C66F98E5D94F1C00C7398234A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 efdd56f081688315b3827c70e75e05a36561e6758b8e03225eeecaa7efb1c64f
MD5 0ebf8eef2337bc5b2f76e4ac30f7d855
SHA1 6111c5f5a83ff05dcb33fa7a5ad11216bcfe05a6
SHA512 b5469306cba7df2e975cbf21ca1293ac434f87696521150d4e1b907653c6b06dcb7372794051bd93566a1b2f644dafb947e49bc9dacfc9cd3ba74100668609a4
SSDEEP 192:zU8ONaVDbiHPQmiU1eX2/Ea+jeOmEtmy8UNmqZHqjlCU8:zU8ONaV6x4uEa+qOfZ0UqCU8
TLSH
T1EF22F73579789C275DE6A148F48B37639EE8107BDC856F88E5D94F1C00C769C234A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6980c696f1854f7c982d72197943a2ea47ab9cd4ce51d7a2be731927528bd4b0
MD5 f8fc499e59e16c24a867d51cbce30cc7
SHA1 4bd77a64ab2e7e1e24c49880eda3676c8d39caf7
SHA512 0fd4d14fa37c84697254f97eb8a5c95a532cc517495f7042eceb664c3af0ba68773634b1873d618ab3a27fd365cf42762e99248a4c12c1c84ff3bc51034e82a2
SSDEEP 192:zU8ONa6DbiHPQmiU1sXIZEa+jeOmEtmy8UNmqZHqjlCU8:zU8ONa66x2iEa+qOfZ0UqCU8
TLSH
T1B3220735797C9C675DE6A148F48737639EE82077DC866F88E6D85F1C00C768C234A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 35572a6839e1095912de7633776f8c2df7deb0b2568a474ad894cb0f50c60ecc
MD5 6ce6d0e8048b0f8af5a5613caf0514b1
SHA1 5964c5d1723463f7c9c1a495a8572f91761631a0
SHA512 945ba7368321c31f6e01a63b4d31eeaf2b3b47b84fb049a09c356007972950da868280bef529a61c9fa44aff46708b178cbae00544661fe157c2435bb9ec04be
TLSH
T1AAE00103EB4005E6D02E17304097161423A7C43987C202579C1002607C003414E32C92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe596306.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596306.TMP
Size 392B
SHA256 e821981658349ea8628886671563ce8233b63dcc3468346e3fd39d55bb7cf578
MD5 0f8dfe464cdd602048f451cc5a25bc25
SHA1 b426a9a4eb16bfd434fdb1eced622601b8d60e2a
SHA512 5e4b0058401c105870ef1e59e01cd705d153c0c2f12ea524dea55efb727d6e60abf7ef137f670a06c143e9fc49b0d8b91c682ac0a2d5033f1bf60cc9570074f6
MD5 SHA1 SHA512

Submit Download

95a4e4fc-d456-41c2-8a9b-b1b727809e2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\95a4e4fc-d456-41c2-8a9b-b1b727809e2a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e231b0f7f86b8da5ab577e4f0dcd8315e98594c104f9a2649e5fc212a1a4b64a
MD5 a7b12f243c7a2c879e76db2cd1f537ee
SHA1 2997e7b61e237c5ed82f31b2eef6830a7e702267
SHA512 ffad1d4c48c219355fc3821ee67233e3923d38e0145057093bdc82bd8e45bb017bade76e8ef599114d08e366686a3593501868ab578308a886104e8f307d19f9
TLSH
T1D741278CA6EA0148B3B76E5A9FF6A96D44BFBC772E0AD45D00110D4F0A22B40D9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

2e57624f-1fc3-463c-a36b-6fc0b5770034.tmp

Path C:\Users\Admin\AppData\Local\Temp\2e57624f-1fc3-463c-a36b-6fc0b5770034.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56539de3-949b-489a-b0f2-03fae3652b70.tmp

Path C:\Users\Admin\AppData\Local\Temp\56539de3-949b-489a-b0f2-03fae3652b70.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\base_library.zip
Size 711KB
SHA256 8e66a86c43e02deb3749cbec38a33d6e1f7fb786843b5982bcb29a5db5646a67
MD5 0bddcd2c1954ed9cf95b39f66ee9c30f
SHA1 4b09fa31a8a6e42f5bcf2b820029d868f0dce8de
SHA512 c543553d81bea63bbbb140204814fffea61ef227a49f6e673b1decb971ed5244c1fc1717cdfa887d6c4f31178bda9c9b86441b7f53f5df66c59115e1319d6f6c
SSDEEP 12288:mbJV0cSO2osQNRs54PK4I1g2jfyE9dHoQDSHk10ax4h00:0V0cSO2osQNRs54PK4I1tjfyE9dHoQDo
TLSH
T16AF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI36242\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee154c07-a17b-494e-8f9e-b9e06b1ce779.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee154c07-a17b-494e-8f9e-b9e06b1ce779.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tch6cuuj.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\an7e00kj\tch6cuuj.exe
Size 5.4MB
SHA256 6256daa014d7ce1a61fce5c6fdb1dd547d3a8362488544b2ddd2abb5a4895da0
MD5 eac9348bad126ce0d76c688bd854dfb4
SHA1 dfb1b35176988d4af82e1fcd94134130ec5aa401
SHA512 594ec4335922eb3333732a961f0186c8694087d99904c619492f48950bcdc3c51dce1c2d8cfee144e4e9bf390485ebcf6534409eac8a49286dde312cb4fb1235
SSDEEP 98304:YKJgtETPzOICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllDHVMRwh6tou:GiiICteErownP0oTcMsABqlAuct7
TLSH
T140463308B3A808E5F9B3E53985565221E872B4254BF0D1CF43AC9A661F677E0BE3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-691-0x0000023B969C0000-0x0000023B96AD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads