Analysis
- max time kernel
1s - max time network
63s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 21:32
General
- Target b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475.exe
- Size 5.4MB
- Sample260822-1dstxack4x
- SHA256 b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1278
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8307
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5654
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1526
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4661
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6539
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8755
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2754
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2744
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5569
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3736
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5542
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8483
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9971
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5632
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7186
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1738
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2997
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5536
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6238
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9543
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1079
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7740
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9414
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5943
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2080
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6190
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4256
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8159
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5015
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3101
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9178
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9789
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5382
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8017
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1718
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3368
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8590
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1896
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7395
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6647
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5640
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5183
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1245
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3692
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5929
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1298
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6233
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8154
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8683
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3881
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5275
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7414
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7856
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2858
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7774
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9565
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9908
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5276
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4916
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9712
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3292
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2150
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9993
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9671
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4729
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4602
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9657
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2494
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5768
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8301
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7688
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3367
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4748
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3832
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1504
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8556
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2913
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4532
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 11 IoCs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 10 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475.exe"C:\Users\Admin\AppData\Local\Temp\b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475.exe"C:\Users\Admin\AppData\Local\Temp\b52d355eb70909c67b1cbc8f1b3e54ffee6752a8f09c405a0c56d49a5cc93475.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x364,0x7ffcf55dc188,0x7ffcf55dc194,0x7ffcf55dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,13151427307112860969,15387601273214400731,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,4014779488814568519,2172702092403216976,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,2246576282749291977,7290371140251058322,262144 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,9824111722417857960,18031717265500787934,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,4922442230059140496,13327777359703174015,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,13840629563495621719,5441811746740702147,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,14164421057814107282,9471314459679214235,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4384,i,3378541426750272368,13410774507700904783,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3984,i,661378524347361353,11101795815694710529,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4892,i,18334753971281899272,14082067114080066333,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,17478668107892681233,16458162175048207102,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7040143762114230183,5141226059292171630,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6036,i,16846374457494857269,6754846747865671298,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6276,i,9295465668324415318,653370728860442639,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6356,i,10390844224459890958,12021016605338837740,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,2247705752658872622,10387330488927176066,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,17434927787864170947,9619243830374413842,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,9370381930571241014,7938888210699680470,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7296,i,334862593936648537,1416298082594977802,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7548,i,16067054989752165636,2688039740612397645,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7340,i,13033674788365568694,3030403864432377129,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7688,i,4213307892244369799,12132591189311442770,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7928,i,16614880433262698438,17494345934364996269,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8068,i,3743773160875715449,15417298845807186684,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=8156 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8316,i,4879467687502548262,4227507843904908262,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=8340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8524,i,16978811205149171578,7753184111361710445,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4624,i,5682276060653238846,4617511019988245865,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5924,i,2636220004913900284,11295535135960667864,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8768,i,6752983972234570486,1979754503330538543,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8788,i,14935669829472835792,18187844275186793942,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9100,i,8053422351436883849,9205832072624617939,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9248,i,13240625616534009073,1382439985125022191,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9332,i,10181486402363067185,9298302188427391424,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9604,i,9233486290819417994,8632477285958029191,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=9568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9084,i,1855526771872991266,10357976700831346587,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9084,i,1855526771872991266,10357976700831346587,524288 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10016,i,10501659644759123289,11455045827491073005,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10044 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10076,i,17676448056836399297,9161679815722152790,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10216 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10376,i,14909436627925458256,5814609557831083327,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10548,i,4648664906433205783,2514778317785465799,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10544,i,17372283284187710908,1864943433151960494,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10396,i,4286769625333793502,934398951359938411,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=10856 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=11032,i,16641825708136231462,11695782826189929908,2097152 --field-trial-handle=2312,i,1888238557878671903,3047015947550654690,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:14⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jqnukxvr\n0o5ogys.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5xtqkuoj\hxo6onrm.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zaonodm4\b4ffdkt5.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ggyn4c0t\b1ea05kz.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghdl4c26\sg4ojqh9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zguhnr2q\vvxx24or.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6w6krz17\pz2y0de6.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8uf79rng\6bi76i9h.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h18ufldw\llbdfqif.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ux3w629d\i2jzsxko.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_00005b
f_00005c
f_00005d
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000063
f_000064
f_000066
f_000067
f_000068
f_000069
f_00006a
f_00006b
f_00006c
SiteList-Enterprise.json
Edge Profile.ico
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
sync_diagnostic.log
e1e9369d-2fd9-4e66-b46e-3b1d3f701c30.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe59c951.TMP
metadata.json
metadata.json
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
uelyog.exe