Analysis
- max time kernel
3s - max time network
63s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 22:27
General
- Target 5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c.exe
- Size 5.4MB
- Sample260822-2dj3fazfkb
- SHA256 5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7228
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4766
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2561
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3277
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5893
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8335
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4379
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2411
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6589
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3434
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9384
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9327
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7422
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3936
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7381
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3458
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6774
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5089
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6092
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6955
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8772
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3661
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1976
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4560
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1079
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6194
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3419
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9661
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9108
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4022
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9493
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9996
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8994
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5550
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1006
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6250
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6979
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2873
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6001
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8968
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3115
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7993
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1693
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1504
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5457
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5592
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6053
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2007
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5177
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3645
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3811
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7821
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3718
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4893
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6664
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7235
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5640
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9391
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1532
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3627
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6998
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8829
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8464
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6752
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3769
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8931
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9933
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8916
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4480
-
Password
password123
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 12 IoCs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Views/modifies file attributes 1 TTPs 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c.exe"C:\Users\Admin\AppData\Local\Temp\5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c.exe"C:\Users\Admin\AppData\Local\Temp\5ea5aaed72ff75678d6951fc82e9499fae7813221a9435b3f2c488ba64d2cf8c.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff9a57cc188,0x7ff9a57cc194,0x7ff9a57cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,6320568134205693902,17905202768077440326,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,12486786330071920907,16283602310998088384,262144 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,15615054367895700948,16215774869370348369,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5832353129700334872,11654447176088926005,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3375323550006431825,7913069378332081120,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2740539946672204816,9450721481771880146,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8546855511867893149,9336237816285863692,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4404,i,8193402031737497662,13174183636661238505,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4696,i,13197734819517791440,8269007837633220469,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4968,i,614975221047875279,11068867391123987150,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5008,i,18439413605358078836,14436841458779835903,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5912,i,9343510359567099320,9340096675228966337,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9939961242535788618,5830066160827334369,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6256,i,16317649160941635301,2736154826586076653,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6464,i,7118027302319019886,1659595665176267435,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,3028703192636711891,14292629587529349552,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,2586433097202239235,1143064875189176076,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,7474077506443380349,8915406634611422314,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6888,i,15504613867969566618,11370571823867064017,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7028,i,17228222957787841833,16156751450536858751,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7220,i,12320249877117994652,4628124496250088878,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7384,i,16972832782804064232,1473228947296858323,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7544,i,9037051971181753053,13162556568077847376,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7684,i,10501522544818952174,3517862666408595465,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7672,i,9909975659429432942,9349929384797436723,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7028,i,4361606891941126560,254381103329081232,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8224 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8684,i,3448903662641534315,15797221280200868449,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8708,i,17429704438976418070,1186224889202047965,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8856,i,16709511665956075561,14401148883290364654,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8756,i,17563964333186992258,12494188695435741460,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9004,i,9213152812818715591,2030781019600220306,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=9304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9476,i,9648206292047050634,8474995269895143133,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9672,i,3959971735415499271,13308072719918405238,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=9684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9796,i,18349080407088308164,1905446652735538995,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=9836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9528,i,5360833280691208963,3310316279220329026,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9528,i,5360833280691208963,3310316279220329026,524288 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=8712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7608,i,15113855624904046064,8593704220936243122,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10352,i,1736724346999266740,581220289425079684,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10408,i,6651298628331055761,16517446143049923512,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10536 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10740,i,5652944582208591204,9066852097663346700,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10776,i,17284693311109441943,1864923266744031139,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10932,i,9586142958158803582,16832820312844156098,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10316,i,12008017680348186058,2053891959199552654,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=11212 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=11336,i,11531926789259729060,5824995641121754041,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=10516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=11512,i,13748391414709402773,10518106010153576525,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=11072 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=11580,i,17057630756207151644,4789067065127782424,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=11684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=11712,i,15962950565592744855,16927183279210807455,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=11844 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12032,i,4805983861977684004,2043149013614529890,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=12064 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=12180,i,17294619913176498622,5864067892796732333,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=12192 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12224,i,6546986883045515013,4021722309371847704,2097152 --field-trial-handle=2740,i,12108601551357933586,15202946053348481836,262144 --variations-seed-version --mojo-platform-channel-handle=12340 /prefetch:14⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2w3xsukj\n4mih1d9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8z2zvcf8\c21fdm3p.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fxk48rxf\8ncysz13.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wgzxbdxu\8j5661ky.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rqkdh8z3\6tf84orc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l0x8mbhx\pogbpb66.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hlla31y\kdfofas7.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ac4nz6s3\e8sdzsc9.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\evoxz7gx\c3dtu32b.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zd1vpo53\9x39239a.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\74ttc2h8\iybpnfti.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt8npq4q\ezfzee1l.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xt8npq4q\ezfzee1l.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_000062
f_000064
f_000065
f_000066
f_000067
f_000068
f_000069
f_00006a
f_00006b
f_00006c
f_00006d
f_00006e
f_00006f
f_000070
f_000071
f_000073
f_000074
the-real-index
the-real-index~RFe59cb84.TMP
SiteList-Enterprise.json
Edge Profile.ico
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
a7569228-39a3-4c98-8a30-41f543faca43.tmp
metadata.json
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
n4mih1d9.exe