Overview

overview

10

Static

static

3

acca126149...02.exe

windows10-2004-x64

10

acca126149...02.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    3s
  • max time network
    61s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 01:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402.exe
  • Size 5.4MB
  • Sample260822-bc995azekf
  • SHA256 acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    138.201.132.148
  • Port

    21
  • Username

    anonymous
  • Password

    [email protected]

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 11 IoCs
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 62 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs
    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Views/modifies file attributes 1 TTPs 12 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402.exe
    "C:\Users\Admin\AppData\Local\Temp\acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5748
    • C:\Users\Admin\AppData\Local\Temp\acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402.exe
      "C:\Users\Admin\AppData\Local\Temp\acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe"
          4⤵
          • Views/modifies file attributes
          PID:4336
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe2ac5c188,0x7ffe2ac5c194,0x7ffe2ac5c1a0
          4⤵
            PID:2428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,3690344449950624098,17839596852448588691,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
            4⤵
            • System Time Discovery
            PID:2664
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,14805084578622540711,4276293615768175832,262144 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
            4⤵
              PID:4808
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,853971407699899333,9352234190818982909,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
              4⤵
                PID:2936
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,1335255660208721861,8484696483618171143,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                4⤵
                  PID:3148
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,4131202806641099353,13435644618711434341,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
                  4⤵
                    PID:5388
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,11470604992407842742,7387109251888377568,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                    4⤵
                      PID:5464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4344,i,10563898347861135756,2590244895207072217,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
                      4⤵
                        PID:1872
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,12565565912863328949,18004716864667275240,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
                        4⤵
                          PID:5412
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4608,i,8313749191117602474,534637773112403559,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
                          4⤵
                            PID:4256
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3908,i,8335885682043470818,9305925757077160443,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
                            4⤵
                              PID:3348
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5740,i,6333071344354682618,6657029210980661218,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
                              4⤵
                                PID:1124
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5872,i,16890499418020528328,15218787048382113384,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
                                4⤵
                                  PID:1584
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,13197826617441983395,9217364463014299183,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                                  4⤵
                                    PID:1844
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6248,i,12057438435701930021,6729605598278391371,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
                                    4⤵
                                      PID:1604
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6412,i,15342307488388742634,9225522291356501305,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
                                      4⤵
                                        PID:5360
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,8399188055553846467,8078116421727527431,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
                                        4⤵
                                          PID:3524
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17787079156277172830,14360085453150060858,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
                                          4⤵
                                            PID:5828
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7024,i,13614260415707617227,17974354025768587243,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
                                            4⤵
                                              PID:1796
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7220,i,7473661971853500459,10907348402157313169,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:1
                                              4⤵
                                                PID:2728
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7372,i,12765606182782258212,1436445049809680292,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
                                                4⤵
                                                  PID:4904
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7568,i,2146107832652067059,16377832118972002755,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:1
                                                  4⤵
                                                    PID:1456
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7724,i,17228361203814039740,16648046819596184983,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:1
                                                    4⤵
                                                      PID:1404
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7876,i,17538335241110302491,15357844758325030843,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:1
                                                      4⤵
                                                        PID:5072
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8400,i,6214420737834964913,9962619160174556628,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:14
                                                        4⤵
                                                          PID:988
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8400,i,6214420737834964913,9962619160174556628,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:14
                                                          4⤵
                                                            PID:4748
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8524,i,17581786450530786065,17447987846591226460,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
                                                            4⤵
                                                              PID:3228
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8692,i,17319724215260103568,14467298067661883232,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:1
                                                              4⤵
                                                                PID:1364
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8888,i,651119566178667948,16034139244383858537,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:1
                                                                4⤵
                                                                  PID:1260
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9040,i,10308471302945097578,10965077401331334495,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:1
                                                                  4⤵
                                                                    PID:6160
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9208,i,14529706311998394001,3203509087451095488,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:1
                                                                    4⤵
                                                                      PID:6288
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9328,i,6960146900002284833,13846440148801269954,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
                                                                      4⤵
                                                                        PID:6392
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,5881654402990793867,15961706926743957423,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:14
                                                                        4⤵
                                                                          PID:6976
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9688,i,11201536836848288709,13727964225676805570,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
                                                                          4⤵
                                                                            PID:6280
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9756,i,7248456675183108064,1043254341161806081,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:1
                                                                            4⤵
                                                                              PID:6744
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10020,i,6416358613084948866,2201435497165183713,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10016 /prefetch:1
                                                                              4⤵
                                                                                PID:6780
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10184,i,1475035574944464741,16302829235115698297,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10200 /prefetch:1
                                                                                4⤵
                                                                                  PID:6936
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7376,i,299048041199114760,11315982432644132552,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:1
                                                                                  4⤵
                                                                                    PID:7064
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10468,i,10883650651485560581,11014516005169126955,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10464 /prefetch:1
                                                                                    4⤵
                                                                                      PID:7080
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7556,i,3922976590486361105,13972879440137885371,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:1
                                                                                      4⤵
                                                                                        PID:6404
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10520,i,18282055424032726988,16677552441150944236,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
                                                                                        4⤵
                                                                                          PID:6556
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7692,i,16787336673289968029,14555065221793992930,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10836 /prefetch:1
                                                                                          4⤵
                                                                                            PID:6548
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=11084,i,3303239093826615475,15323442768264770224,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=11100 /prefetch:1
                                                                                            4⤵
                                                                                              PID:6648
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=10812,i,18445334435394879080,2592632692008204848,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=10492 /prefetch:1
                                                                                              4⤵
                                                                                                PID:7108
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7720,i,17009136468061188716,9481000594014218414,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=11404 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:5496
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11156,i,13107307909218593058,3583988680394329530,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=11852 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:7780
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=12060,i,6320332296728831837,15540573427334875679,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=12068 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:7904
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=12240,i,1966007021655569237,550066403125343341,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=12236 /prefetch:1
                                                                                                      4⤵
                                                                                                        PID:7980
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=12368,i,17810303373446237260,3817223029098325548,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=12404 /prefetch:1
                                                                                                        4⤵
                                                                                                          PID:8096
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6200,i,9828850103486133314,14888545026234239780,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
                                                                                                          4⤵
                                                                                                            PID:7228
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=12656,i,2293338495483246837,13102599742026306703,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:7292
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=12808,i,2353090309428022073,7863320368001155762,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=12840 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:7368
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=6156,i,7250560993842197370,3308448587722506953,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=12896 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:7460
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12648,i,13000379637809090724,6401002560039723721,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13120 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:7612
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,11346663240053632633,8284792692675995782,524288 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:12
                                                                                                                    4⤵
                                                                                                                      PID:7768
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=13356,i,8497831749903547977,17889864368712602965,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13368 /prefetch:1
                                                                                                                      4⤵
                                                                                                                        PID:8016
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=13504,i,15052619459141923333,4225832667456732177,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13520 /prefetch:1
                                                                                                                        4⤵
                                                                                                                          PID:8032
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=13580,i,13441092278163010294,15359036682910348919,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13712 /prefetch:1
                                                                                                                          4⤵
                                                                                                                            PID:8256
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=13568,i,11418702429467013441,8510577303936449486,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13884 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:8364
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=4384,i,7645303091304109383,13702026632102744542,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=14032 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:8724
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=14148,i,16079396246677583165,14672586960121191538,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=14164 /prefetch:1
                                                                                                                                4⤵
                                                                                                                                  PID:8856
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=13600,i,12949748033098383698,5067401570938016905,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=13568 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:8988
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=14652,i,11875222911044472019,2888191981626392640,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=14616 /prefetch:1
                                                                                                                                    4⤵
                                                                                                                                      PID:9104
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=14788,i,8246513030918717594,5727506511073408956,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=14140 /prefetch:1
                                                                                                                                      4⤵
                                                                                                                                        PID:8472
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=14792,i,15853064223362198297,6158352899597625045,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=14840 /prefetch:1
                                                                                                                                        4⤵
                                                                                                                                          PID:5700
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=15140,i,11702003161573759396,15437136385883229944,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=15168 /prefetch:1
                                                                                                                                          4⤵
                                                                                                                                            PID:9188
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=15176,i,12770196529618248757,5650016412994912346,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=15316 /prefetch:1
                                                                                                                                            4⤵
                                                                                                                                              PID:8656
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=15464,i,2136506103666375860,5593772496321978356,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=15472 /prefetch:1
                                                                                                                                              4⤵
                                                                                                                                                PID:8116
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=15680,i,15763033780825817696,1787483731671301063,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=15688 /prefetch:1
                                                                                                                                                4⤵
                                                                                                                                                  PID:3112
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=15788,i,16523773571071885540,14946389964404973199,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=15796 /prefetch:1
                                                                                                                                                  4⤵
                                                                                                                                                    PID:8968
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=15980,i,18251222370110166916,7240356890820797863,2097152 --field-trial-handle=2300,i,16765451723764302401,1508339597586044874,262144 --variations-seed-version --mojo-platform-channel-handle=16008 /prefetch:1
                                                                                                                                                    4⤵
                                                                                                                                                      PID:9304
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2080
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3916
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1308
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1580
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1600
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1076
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5936
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                  PID:6116
                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                    PID:2740
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1600
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2580
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1716
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3432
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:2800
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:1204
                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bxp7gnhu\m9kro55a.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1308
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                PID:612
                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                  PID:3472
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1416
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:856
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:6072
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5496
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:6324
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:6548
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:6604
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\u9ziv438\cmbyl0bw.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6696
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                PID:6856
                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:6944
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:6648
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7052
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6184
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:7020
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:7084
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6308
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ld7t0ekw\z3v24nsb.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:7436
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                              PID:7600
                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                PID:7700
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:7852
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:7960
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:8028
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:8136
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:7300
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:7688
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ylssf5f\38ko7nqo.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:8028
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                            PID:7680
                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:7852
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3196
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:8196
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:8356
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:8968
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:9112
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yc7vmcy9\ivxh4x8f.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:8496
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                          PID:7888
                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3112
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:8484
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:8984
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:8548
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:8512
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:9252
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pdubxd9d\it8z7qvt.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:9652
                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                        PID:9852
                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                          PID:10016
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:10072
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:10172
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:10220
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:9320
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:9556
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3hs5r5km\jrclo4bo.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:9624
                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                      PID:9460
                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                        PID:9748
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:9704
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:9920
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:9884
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:9988
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:9956
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:10096
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t5lemqnq\anjn0hzk.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:10232
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                    PID:9280
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:9568
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:9448
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:9748
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:9504
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:9864
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:10032
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d8swe3k0\rlfcd6sf.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:10204
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                    PID:9444
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:9688
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:9768
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:2596
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:7552
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:6064
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:9592
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uqjqosg3\js6chfq7.exe
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:9740
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                PID:7556
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                  PID:7564
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:9612
                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:9896
                                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:10120
                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:9612
                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:6064
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:9896
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0lyshxb\5w6zr6iz.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:8860

                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                                                              • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                                                                              • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00006e
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                                                                                                                                                                                                                                              • Size 45KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e29aab6f06e374089ff301ce5ab59d4ef56ea95df55396948e439ea7613168da
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00006f
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
                                                                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                                                                              • SHA256 d5147b4199360af8d7d0cb97745bab45b0a0e58b0ca5125b4b1d5a0989bd8947
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000070
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                                                                                                                                                                                                                                                                              • Size 58KB
                                                                                                                                                                                                                                                                                                                              • SHA256 0c3c3da3298ae86a6be5f22d9fe798e087b144bee1d751df051af635619cc461
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000071
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                                                                                                                                                                                                                                                                              • Size 43KB
                                                                                                                                                                                                                                                                                                                              • SHA256 6e99b810ad4dcbaf34328873b99a6cbe465c7cb3fb324711d026e066edfe0496
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000072
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
                                                                                                                                                                                                                                                                                                                              • Size 40KB
                                                                                                                                                                                                                                                                                                                              • SHA256 624fcb4d684faab18c2c904a828058febed7bb671902102430d2e221c785098c
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000073
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
                                                                                                                                                                                                                                                                                                                              • Size 75KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000074
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
                                                                                                                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                                                                                                                              • SHA256 a2880f48dcce2eff742bf04436a8a81b7d73e2672b7ce936c9a74b26c7296bef
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000075
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
                                                                                                                                                                                                                                                                                                                              • Size 52KB
                                                                                                                                                                                                                                                                                                                              • SHA256 a2a9b5adec3251313b8bc3fe1f558963ae94fb2558d6d3b80eb4513c96dea6a1
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000076
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
                                                                                                                                                                                                                                                                                                                              • Size 75KB
                                                                                                                                                                                                                                                                                                                              • SHA256 655373bfa582ae26b5ba636d935b29bdba45c2a786060e3182e06382bfd8f0ba
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000077
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
                                                                                                                                                                                                                                                                                                                              • Size 77KB
                                                                                                                                                                                                                                                                                                                              • SHA256 165fdf7d8b04b124d1870d123199f553c8b277b160ae4ff933fe9f8c9866b976
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000078
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
                                                                                                                                                                                                                                                                                                                              • Size 78KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b696de4566649d04bf2b0ba4323a9ab175980552528d8a5914e86e6746787a64
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000079
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
                                                                                                                                                                                                                                                                                                                              • Size 124KB
                                                                                                                                                                                                                                                                                                                              • SHA256 ce7ac8e7576e3a90e69912114a05a9be0f05bccd2ccd20527846b1404752c416
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00007a
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
                                                                                                                                                                                                                                                                                                                              • Size 280KB
                                                                                                                                                                                                                                                                                                                              • SHA256 caf48362186b4352c6300c81716b84090fc418b92f4c03db9c024c6dcd47b215
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00007b
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
                                                                                                                                                                                                                                                                                                                              • Size 219KB
                                                                                                                                                                                                                                                                                                                              • SHA256 7b56a7da61230728af5137c2a3e3fa88d9093f82b956b6de298fa4f54ec013ac
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00007c
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
                                                                                                                                                                                                                                                                                                                              • Size 246KB
                                                                                                                                                                                                                                                                                                                              • SHA256 9cd7f5deabbdb1d63ee7fa797fa47dc890e72a7295fe8da9fbf57749c99d9b77
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00007d
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
                                                                                                                                                                                                                                                                                                                              • Size 631KB
                                                                                                                                                                                                                                                                                                                              • SHA256 3d522b95eb6b9e9bf611ae6e25232a8633e88c1b459d3e128cdbab02d8a3a1a2
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000082
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
                                                                                                                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                                                                                                                              • SHA256 5e4611fdb5c7906e74b744366efc4778029bd654117c564a285dba17d1183e12
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000083
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
                                                                                                                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                                                                                                                              • SHA256 531e91672daf6063fd6be177ffbc47be83f7091cb8824537bef79bac20102f0e
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000084
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
                                                                                                                                                                                                                                                                                                                              • Size 19KB
                                                                                                                                                                                                                                                                                                                              • SHA256 d60d307db85847b82b11288fe460505dc4068f49faf14688b67374d39e0a6f7b
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000085
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                              • SHA256 10502836eab0055fd85f524dcdcac18d339736eed9e63d54dba5eebed120f240
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000087
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
                                                                                                                                                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                                                                                                                                                              • SHA256 d680fe3771a320a159fab78bd63c08fb6cc2b702a55e568a2667ac30bfe7b0f5
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000088
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
                                                                                                                                                                                                                                                                                                                              • Size 21KB
                                                                                                                                                                                                                                                                                                                              • SHA256 d87ee0accef9bf0955a0e85e7e458b19c2bcab2b0ad53f350d3d2b3b6f740f99
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000089
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
                                                                                                                                                                                                                                                                                                                              • Size 36KB
                                                                                                                                                                                                                                                                                                                              • SHA256 88b7296d381a5f93e52dab42497fc29bd7dc8ba67eb83228e4164b8b9e58ffd8
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000090
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
                                                                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                                                                              • SHA256 41d5e9a00c94e34764dbf0bc12b2e874e537cb093ae45fd03cebc9e94afbba10
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000091
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                                                                              • SHA256 f6c159658b8b577a29ca132d548c7e7f55b5f1e316759077553e282c370966df
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000092
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                                                                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b51cffd4dd1bfcd020fe72f1e2209f2778f5cb2d25851b492cdb15fd63d2bfdb
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_000093
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
                                                                                                                                                                                                                                                                                                                              • Size 92KB
                                                                                                                                                                                                                                                                                                                              • SHA256 de8b043363106f77b0fb50cdc5c8b511736374767fb5e73746805556d246dca7
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00009d
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                                                                                                                                                                                                                                                                              • Size 44KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e790f53e529219a3fb8b3579cb5beb36276c2a98c02d612757ccec5917940b79
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00009e
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
                                                                                                                                                                                                                                                                                                                              • Size 21KB
                                                                                                                                                                                                                                                                                                                              • SHA256 27fbf1cc76894c289357a1601105392f1dbaafaba15daa258c954487b507718d
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_00009f
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
                                                                                                                                                                                                                                                                                                                              • Size 147KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b3790aaf2c91dc30c90a8e9bc622d7dd480aedbd56550e082f040af9aa10ca62
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_0000a0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
                                                                                                                                                                                                                                                                                                                              • Size 42KB
                                                                                                                                                                                                                                                                                                                              • SHA256 27b101995cd472351bca908614bf320fe018cd6fa171a979ce37a810e1732d85
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_0000a1
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
                                                                                                                                                                                                                                                                                                                              • Size 33KB
                                                                                                                                                                                                                                                                                                                              • SHA256 61b7ec0cd4189f4bd47025c9776bd50871b7e62dc5c9f7bfd96ec34dd9cbc4be
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f_0000a2
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
                                                                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                                                                              • SHA256 43078647f3bd86002cc2d165f4439181afa7d53c7b271cf5a02071cc25d6909b
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              1d5469ee4097c17b_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1d5469ee4097c17b_0
                                                                                                                                                                                                                                                                                                                              • Size 112KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e408e9826fd5387e06a847f6ee5eaf785b5f5ad4567c74bb069b07abf5b778b0
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              20703ecb5463c2bb_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20703ecb5463c2bb_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 05e315cef5cc1dce07c83f5c5c389ebf70c5c76f22a0fb0f3965eaebc28785be
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              299902730a682ba6_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\299902730a682ba6_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 79ff210cced0c20e14cd2665760d210ca4a03ca72b243cbbc83cca784d27372a
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              3883416a59073009_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3883416a59073009_0
                                                                                                                                                                                                                                                                                                                              • Size 602B
                                                                                                                                                                                                                                                                                                                              • SHA256 6bcb2976976f4d3285f3be4e8b8779e9b21bff2bc6f6950328967c019e2063b2
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              4202ecb61543d654_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4202ecb61543d654_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 c6a7a61d319cd9aae11288b376fdeeaef9027a52d6a1aee1898f2b24e5883e8f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              55b63908cdfb4e54_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55b63908cdfb4e54_0
                                                                                                                                                                                                                                                                                                                              • Size 371B
                                                                                                                                                                                                                                                                                                                              • SHA256 4d0667db3e8b54fd9a999eff10e7fea1a4eca10d46cd6eef44736fde6a55acb2
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              591d65d82d96a83b_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\591d65d82d96a83b_0
                                                                                                                                                                                                                                                                                                                              • Size 346KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b048685ecbf5051fbdb438f40c3fa6fea66705e16892401573fdb265d4c90237
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              59643e28282df92b_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\59643e28282df92b_0
                                                                                                                                                                                                                                                                                                                              • Size 206KB
                                                                                                                                                                                                                                                                                                                              • SHA256 51ffde0107b18f6bd32eb99bd52ecd3545981abb5f8605a4ae044732a2519aa4
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              6979d759b762a7a3_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6979d759b762a7a3_0
                                                                                                                                                                                                                                                                                                                              • Size 270B
                                                                                                                                                                                                                                                                                                                              • SHA256 41626098b88a5e09bf4f7140f588c60ad7b02407c052c9912b9b407b73434678
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              74f86fe198bac291_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74f86fe198bac291_0
                                                                                                                                                                                                                                                                                                                              • Size 157KB
                                                                                                                                                                                                                                                                                                                              • SHA256 7d82dd094f947a8691c7816a4c51418fc286f9d42d828a599cd163cdad296a98
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              7bc95d0bf120d0e3_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7bc95d0bf120d0e3_0
                                                                                                                                                                                                                                                                                                                              • Size 288KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e319fbf17c2a9c650c8b55336f715ec8a6d795a31efd85a280ed01ba4e6b52fb
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              90cd80525ca24fef_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90cd80525ca24fef_0
                                                                                                                                                                                                                                                                                                                              • Size 91KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b0a9372a4437ce6db9e9a1679f04c8acd0ce2905b30c99948d30fec8d4b4d9d0
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              94ec5a7dcfab13c1_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94ec5a7dcfab13c1_0
                                                                                                                                                                                                                                                                                                                              • Size 584KB
                                                                                                                                                                                                                                                                                                                              • SHA256 8530745bb2edb06d149fad1a0d7c8c79ada53dbb7a89fe8e23cc7ef260286bb6
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              a8a630c2eefb539b_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8a630c2eefb539b_0
                                                                                                                                                                                                                                                                                                                              • Size 270B
                                                                                                                                                                                                                                                                                                                              • SHA256 4aeb556bde1343bfb40db4862333b412385598fa908110022b92152999ba49f6
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              a9d941a2225e16c6_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a9d941a2225e16c6_0
                                                                                                                                                                                                                                                                                                                              • Size 96KB
                                                                                                                                                                                                                                                                                                                              • SHA256 9c5cae4fba270768912a187ab8d0f35b735557eef6814454593fa80ac5f1f83b
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              b50fa2df1d57f8e8_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b50fa2df1d57f8e8_0
                                                                                                                                                                                                                                                                                                                              • Size 1.6MB
                                                                                                                                                                                                                                                                                                                              • SHA256 e16efdadd52ac165283bd7a65f1b05f13a6f734a00555fc42cb900239e9086b5
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              b60d1ea1595e5745_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b60d1ea1595e5745_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 aa4f0ab1da44a2071be58f205326d8558b9691f0ef49eb97bbdf10130531595a
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              b6b25c78c26c4d2b_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b6b25c78c26c4d2b_0
                                                                                                                                                                                                                                                                                                                              • Size 426B
                                                                                                                                                                                                                                                                                                                              • SHA256 4b4fd7a0f5721848a38795f10e0ddc80b83e2bc7e857819835e0c0d669625b02
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              b9b72378768140f1_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b9b72378768140f1_0
                                                                                                                                                                                                                                                                                                                              • Size 470B
                                                                                                                                                                                                                                                                                                                              • SHA256 7654b40b94429e68c77e9ba4949b264d347e30098e10f14756a709e8cc993409
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              c3021707c43b6d77_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c3021707c43b6d77_0
                                                                                                                                                                                                                                                                                                                              • Size 94KB
                                                                                                                                                                                                                                                                                                                              • SHA256 958f32f1009370e5fa9a56becce284ea1fdf568e39178cff4990841e680bca6e
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              d2a212faf75473b8_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d2a212faf75473b8_0
                                                                                                                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                                                                                                                              • SHA256 6d11ae20a715825df87d70096c5f45df3d49d4b25b8c88d7c6dcead0fc85c713
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              e5bae644092e7f57_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e5bae644092e7f57_0
                                                                                                                                                                                                                                                                                                                              • Size 134KB
                                                                                                                                                                                                                                                                                                                              • SHA256 92e91d9636e863aa03133297576c470bc2fe4d04a466333c9f055495cba40006
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f14a8addf86370a8_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f14a8addf86370a8_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 b86821503098a5eb9a953f2bd8d85b3b07be3748ba3e3443bb0eebe4fa768eee
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f162e9684ccdf73c_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f162e9684ccdf73c_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 1e6412f26e8065eb8f02f2b8810bf8f2459e254db2d97d23ea42154d945f2207
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f4520aa622994c45_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f4520aa622994c45_0
                                                                                                                                                                                                                                                                                                                              • Size 220KB
                                                                                                                                                                                                                                                                                                                              • SHA256 f1a4bc23674f617564388dc69a8af698ac38f78d5d6768a6e199d0e17cb3adc0
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f59cd510b90c381f_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f59cd510b90c381f_0
                                                                                                                                                                                                                                                                                                                              • Size 283B
                                                                                                                                                                                                                                                                                                                              • SHA256 c5ec2931df82352a05c93774d65ad3475e8f0363e768fd6d2ee13054a754342a
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f7a910c9b3f60ec5_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f7a910c9b3f60ec5_0
                                                                                                                                                                                                                                                                                                                              • Size 270B
                                                                                                                                                                                                                                                                                                                              • SHA256 60c9a2a2047a0f12461eb17fc7e88c48962be2285b02b381bb64f12d8bc4e1e7
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              f8ab88daf05a0c45_0
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8ab88daf05a0c45_0
                                                                                                                                                                                                                                                                                                                              • Size 135KB
                                                                                                                                                                                                                                                                                                                              • SHA256 bad48e88a84560c1989d7d3bd2283ffecdea76a8abd6e9a220b1ffee04f8e52c
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                              • Size 40B
                                                                                                                                                                                                                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                                                                              • SHA256 5bbcf44fbb457a5408b0bd4c1aee1467188b4157faf220e492f42d624a15090f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e48fecee9cc5eeaddec71e44bff69643dccfeb2f30bdcae4ea668e99ad0f3b7f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                              • Size 14KB
                                                                                                                                                                                                                                                                                                                              • SHA256 216f3b85c3487910e77a0cd44a42d8390ffed33a7a95e5da0e026b38dcf0d97e
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                                                                                                                              • SHA256 069f59dbf7651ca65722315a7d58355ab20007c667cbe5e67bb538ba68c104a0
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                                                                                                                              • SHA256 90e20627f4cf8a5c31c0033942a4751b1a2d517bc1a6058b75db7fc35edc0344
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 38KB
                                                                                                                                                                                                                                                                                                                              • SHA256 272b6ee92f69e100ac574f638e2fde77d85523e668d545f86910363a7310434f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 33KB
                                                                                                                                                                                                                                                                                                                              • SHA256 406b53dbaece7de8e56890598b2e38519472624d600df174e476e9c08fe64021
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                              • SHA256 148e4df005f4fab2de3768b2de5bbc77237bbd5d87b8ec726a800fd3a47d92d4
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 39KB
                                                                                                                                                                                                                                                                                                                              • SHA256 847c56c4114b46788823e4580a339c299aec2dd1769af333198d762f165fcc56
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 33KB
                                                                                                                                                                                                                                                                                                                              • SHA256 74160b31348e04169fc0909601fa927f4af84893b34a90ea339f7715c9380065
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 33KB
                                                                                                                                                                                                                                                                                                                              • SHA256 1956fbcac8bcac290f7ee43e1e5f59b3b75b9db3ecca07b273b7b0c955047bfd
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                                                                                                                              • SHA256 60b8edc682cb09474aa4a478ca9abce0c070717f97beead39dac81172435e1fc
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                                                                                                                              • SHA256 91aecd1e86c8cdb5424fd46d0d053446e098a237582fd25a28ceb07611792372
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                                                                                                                              • SHA256 63388ae9d6ef9cecbc66ef458e2c15ee58bc51c5bb9c1f7c1d088b1f51ebdda4
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                              • Size 34KB
                                                                                                                                                                                                                                                                                                                              • SHA256 4d123722c5fb2ffa1b5391d63fae8acb28ba3c62f9d52f88c1eb1b37cbf182b0
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              aad46b8b-8e41-4252-9162-bf61ce632698.tmp
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aad46b8b-8e41-4252-9162-bf61ce632698.tmp
                                                                                                                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                                                              • Size 154KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              metadata.json~RFe596509.TMP
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe596509.TMP
                                                                                                                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                                                                                                                              • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              2649e32f-3f54-4fca-b44b-d7d1328903a2.tmp
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2649e32f-3f54-4fca-b44b-d7d1328903a2.tmp
                                                                                                                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                              • Size 94KB
                                                                                                                                                                                                                                                                                                                              • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _bz2.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_bz2.pyd
                                                                                                                                                                                                                                                                                                                              • Size 84KB
                                                                                                                                                                                                                                                                                                                              • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _decimal.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_decimal.pyd
                                                                                                                                                                                                                                                                                                                              • Size 265KB
                                                                                                                                                                                                                                                                                                                              • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _hashlib.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                              • Size 64KB
                                                                                                                                                                                                                                                                                                                              • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _lzma.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_lzma.pyd
                                                                                                                                                                                                                                                                                                                              • Size 159KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _socket.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_socket.pyd
                                                                                                                                                                                                                                                                                                                              • Size 78KB
                                                                                                                                                                                                                                                                                                                              • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _ssl.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_ssl.pyd
                                                                                                                                                                                                                                                                                                                              • Size 151KB
                                                                                                                                                                                                                                                                                                                              • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              _uuid.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\_uuid.pyd
                                                                                                                                                                                                                                                                                                                              • Size 23KB
                                                                                                                                                                                                                                                                                                                              • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              base_library.zip
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\base_library.zip
                                                                                                                                                                                                                                                                                                                              • Size 711KB
                                                                                                                                                                                                                                                                                                                              • SHA256 8a83ecc21cee6f9af303b2e03eb3b88cc86663455a6636ab288381ddc8afef2d
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                              • Size 3.3MB
                                                                                                                                                                                                                                                                                                                              • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                              • Size 678KB
                                                                                                                                                                                                                                                                                                                              • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              python39.dll
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\python39.dll
                                                                                                                                                                                                                                                                                                                              • Size 4.3MB
                                                                                                                                                                                                                                                                                                                              • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              select.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\select.pyd
                                                                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                                                                              • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              unicodedata.pyd
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI57482\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                              • Size 1.1MB
                                                                                                                                                                                                                                                                                                                              • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                                                                              q9ns0quu.exe
                                                                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bn2xwfne\q9ns0quu.exe
                                                                                                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                                                                                                              • SHA256 acca126149266bad0b99b6c077336e0ed328755163539a6bdedb0587e3742402
                                                                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                              Submit Download