f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c

Analysis

max time kernel
4s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
Size 5.4MB
Sample260822-bpswlst1ft
SHA256 f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c
MD5 72e3cef730653e954051afca81d408ce
SHA1 af1f79e0f7e97eb9092c87a9a13582935e1b7fd3
SHA512 4b7eed0d0d963677dbc21b9278e932315b980d2a008b010cd549d6fb8b034c2095852ba27b8581238bea1095f76917253c0a1c97e1c1473815ced69d34ff84d9
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zR5:OrICteErownP0oTcMsABqlaOzj
TLSH
T1CC463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AE7B750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5077
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6786
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4704
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9600
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3229
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9239
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2733
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2872
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1686
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7090
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7320
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8798
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2700
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8992
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9390
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1154
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8202
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3571
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1779
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5757
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4805
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9446
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9942
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9198
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8058
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4973
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9313
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1275
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6505
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9669
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5287
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9123
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5793
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8650
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5391
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2719
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6083
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9471
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5062
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6831
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4639
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3108
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1234
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9190
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5005
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2740
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3976
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4082
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8323
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3156
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6866
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1040
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1054
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5234
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7232
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4075
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7493
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8296
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4647
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2795
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7264
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6484
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3501
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5154
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9465
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5901
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7849
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3174
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4419
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8375
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9628
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icaufc.exe	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\icaufc.exe	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe

Loads dropped DLL 11 IoCs

pid	Process
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\vgquo6r8\\ijey1uz3.exe"	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
120	ifconfig.me
177	ifconfig.me
1919	ifconfig.me
3393	ifconfig.me
3412	ifconfig.me
1171	ifconfig.me
1771	ifconfig.me
2326	ifconfig.me
2975	ifconfig.me
4282	ifconfig.me
739	ifconfig.me
1095	ifconfig.me
1399	ifconfig.me
2742	ifconfig.me
555	ifconfig.me
777	ifconfig.me
876	ifconfig.me
2700	ifconfig.me
3552	ifconfig.me
589	ifconfig.me
1321	ifconfig.me
1458	ifconfig.me
3772	ifconfig.me
89	ifconfig.me
3498	ifconfig.me
4230	ifconfig.me
76	ifconfig.me
3381	ifconfig.me
1286	ifconfig.me
2019	ifconfig.me
53	ifconfig.me
1099	ifconfig.me
1270	ifconfig.me
1556	ifconfig.me
164	ifconfig.me
299	ifconfig.me
800	ifconfig.me
843	ifconfig.me
1507	ifconfig.me
2080	ifconfig.me
2207	ifconfig.me
2542	ifconfig.me
263	ifconfig.me
1812	ifconfig.me
2297	ifconfig.me
2342	ifconfig.me
2682	ifconfig.me
3197	ifconfig.me
3695	ifconfig.me
52	ifconfig.me
198	ifconfig.me
438	ifconfig.me
702	ifconfig.me
3208	ifconfig.me
793	ifconfig.me
3049	ifconfig.me
302	ifconfig.me
3434	ifconfig.me
3745	ifconfig.me
367	ifconfig.me
952	ifconfig.me
2434	ifconfig.me
264	ifconfig.me
422	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5288	cmd.exe
7540	cmd.exe
8136	cmd.exe
7756	cmd.exe
7508	cmd.exe
7932	cmd.exe
2044	cmd.exe
4516	cmd.exe
6716	cmd.exe
7588	cmd.exe
8200	cmd.exe
4724	cmd.exe
1180	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5596	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3344	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 5740	2868	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	89
PID 5740 wrote to memory of 4724	5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	90
PID 4724 wrote to memory of 4276	4724	cmd.exe	92
PID 5740 wrote to memory of 3344	5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	93
PID 5740 wrote to memory of 4408	5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	94
PID 3344 wrote to memory of 4320	3344	msedge.exe	95
PID 5740 wrote to memory of 3408	5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	96
PID 5740 wrote to memory of 480	5740	f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe	98
PID 3344 wrote to memory of 4900	3344	msedge.exe	99
PID 3344 wrote to memory of 5596	3344	msedge.exe	100
PID 3344 wrote to memory of 4900	3344	msedge.exe	99
PID 3344 wrote to memory of 4900	3344	msedge.exe	99
PID 3344 wrote to memory of 252	3344	msedge.exe	101
PID 3344 wrote to memory of 252	3344	msedge.exe	101
PID 3344 wrote to memory of 2988	3344	msedge.exe	103
PID 3344 wrote to memory of 2988	3344	msedge.exe	103
PID 3344 wrote to memory of 2988	3344	msedge.exe	103
PID 3344 wrote to memory of 5800	3344	msedge.exe	104
PID 3344 wrote to memory of 5800	3344	msedge.exe	104
PID 3344 wrote to memory of 5800	3344	msedge.exe	104
PID 3344 wrote to memory of 808	3344	msedge.exe	105
PID 3344 wrote to memory of 808	3344	msedge.exe	105
PID 3344 wrote to memory of 808	3344	msedge.exe	105
PID 3344 wrote to memory of 4952	3344	msedge.exe	259
PID 3344 wrote to memory of 5912	3344	msedge.exe	107
PID 3344 wrote to memory of 4952	3344	msedge.exe	259
PID 3344 wrote to memory of 4952	3344	msedge.exe	259
PID 3344 wrote to memory of 5912	3344	msedge.exe	107
PID 3344 wrote to memory of 5912	3344	msedge.exe	107
PID 3344 wrote to memory of 4456	3344	msedge.exe	108
PID 3344 wrote to memory of 4456	3344	msedge.exe	108
PID 3344 wrote to memory of 4456	3344	msedge.exe	108
PID 3344 wrote to memory of 1908	3344	msedge.exe	109
PID 3344 wrote to memory of 1908	3344	msedge.exe	109
PID 3344 wrote to memory of 1908	3344	msedge.exe	109

Views/modifies file attributes 1 TTPs 13 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5572	attrib.exe
1548	attrib.exe
5060	attrib.exe
3376	attrib.exe
5492	attrib.exe
7596	attrib.exe
7048	attrib.exe
7712	attrib.exe
4276	attrib.exe
7920	attrib.exe
7660	attrib.exe
7200	attrib.exe
6136	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
"C:\Users\Admin\AppData\Local\Temp\f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe
  "C:\Users\Admin\AppData\Local\Temp\f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe"
      4⤵
      Views/modifies file attributes
      PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ff8c7c8c188,0x7ff8c7c8c194,0x7ff8c7c8c1a0
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,17291488417340708293,17165936575948528513,262144 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,17395184402951519977,4765749098672737445,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,4249490585798059165,2843755947823291707,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,13650454105170573072,874817966338035828,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,11824960527437241212,3733986452123277204,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3956,i,15508944053817944650,4583873720619345844,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4136,i,11488210417445083876,4862583028125688359,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4008,i,9339920395545562962,17562750437912822419,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4400,i,14550899168328895457,2221398786038269793,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4684,i,11446182853152984865,2732577457243914085,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5736,i,15050369746069406895,999196483037215460,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,1338123554734825096,7401450205988758119,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6084,i,11485825944591936551,8463659925374215859,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6276,i,14143705183820690503,13872892081909574927,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6444,i,12923254512790036563,15891726441838552267,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,18412467402076119718,8880899085534214337,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,18412467402076119718,8880899085534214337,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4374389843696605568,8114758251520073327,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6760,i,8796504340528280060,2733280712353896647,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6792,i,7793192364734677126,13004419023824075372,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6808,i,758464898899013359,9127896200235331775,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6844,i,17453207361803535245,18446145274388183964,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6872,i,1506661443165580705,8365127137508616692,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6896,i,17559051424817446186,13857347378872777992,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:1
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6964,i,3476078176843473386,17029312841480065186,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7336,i,11576655107574752264,11653475226259724448,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8180 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7328,i,12263795363717013553,3739628142494909585,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5240,i,839872043229118919,801491641410630192,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7388,i,15089742290728525834,5592188936823266324,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:1
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,1835789706801444102,15842096142108686618,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:14
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6932,i,5413623718554226999,3473024424757939108,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7256,i,17065635686607271123,15591372431792718299,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7412,i,13638016935404656579,3363169664717361770,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4780,i,16607911548682543465,1309640140096960315,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7732,i,17567027797344035359,3694002070138211221,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7756,i,10799281738079626411,8543007271687261558,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7716,i,16471464612747919127,12302987393784332654,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:1
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7764,i,9924812517812758946,3517225416254927624,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8732 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8012,i,16858587478216716214,4424144239811256561,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:1
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8084,i,8168435507742961909,12449880973959023494,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7592,i,5214813931447786098,14233422506383340604,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,3085327101061009084,18288951498452539593,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7964,i,3028227710988602409,4081566990168021695,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7600,i,14175598305012307993,2393767366333361828,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7552,i,17973397632554997031,16625595246640789599,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:1
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7676,i,15528338994516526784,5473655866865879280,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7580,i,18432299661386395691,8259967595784507025,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7448,i,5462814285763249812,13093858753888810586,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7968,i,14358753592911280855,8547655449536479752,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8004,i,16468446401582458391,5092886870670391509,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:1
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=11296,i,8492687255189132615,1423949757193036585,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12140 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=12196,i,17271736881507520848,5190536746482351589,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12300 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=12444,i,18101611276725520195,17840918473324417040,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12472 /prefetch:1
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12824,i,15550450512710991454,12885349690591774926,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:12
      4⤵
      PID:7324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,6663117145783168955,11730241816018113671,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12220 /prefetch:14
      4⤵
      PID:7452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12260,i,17519568598025523758,14253755219748785622,524288 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12172 /prefetch:14
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=12704,i,16633780133307887099,5351030176984740927,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12188 /prefetch:1
      4⤵
      PID:7752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=12640,i,2649735874647205789,2606241186881452912,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12200 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=4316,i,4499291626380295893,289554204550010988,2097152 --field-trial-handle=2292,i,12136233593327172749,10883533054646510137,262144 --variations-seed-version --mojo-platform-channel-handle=12144 /prefetch:1
      4⤵
      PID:7908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1976

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe
1⤵
PID:1116
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe
  2⤵
  PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1180
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe"
      4⤵
      Views/modifies file attributes
      PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1768

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe
1⤵
PID:4616
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\trmnimuy\jwj6n5z5.exe
  2⤵
  PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5288
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe"
      4⤵
      Views/modifies file attributes
      PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5628

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe
1⤵
PID:5100
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2cah5urb\73pqb5c6.exe
  2⤵
  PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2044
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe"
      4⤵
      Views/modifies file attributes
      PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1988

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe
1⤵
PID:5060
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o66ovd06\qont00pu.exe
  2⤵
  PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4516
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe"
      4⤵
      Views/modifies file attributes
      PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6068

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe
1⤵
PID:6744
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6duu39f\ypddx8e9.exe
  2⤵
  PID:7020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6716
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe"
      4⤵
      Views/modifies file attributes
      PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7296

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe
1⤵
PID:7380
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cjtk8jzn\36xv6i5q.exe
  2⤵
  PID:7468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7540
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe"
      4⤵
      Views/modifies file attributes
      PID:7596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7972

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe
1⤵
PID:8024
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lys8f74f\mwabm7wq.exe
  2⤵
  PID:8096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8136
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe"
      4⤵
      Views/modifies file attributes
      PID:7048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7516

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe
1⤵
PID:5936
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm9pmn1n\c8ecaong.exe
  2⤵
  PID:7812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7756
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe"
      4⤵
      Views/modifies file attributes
      PID:7920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7332

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe
1⤵
PID:7416
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i007mnx1\c0f61olx.exe
  2⤵
  PID:7556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7588
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe"
      4⤵
      Views/modifies file attributes
      PID:7712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7228

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe
1⤵
PID:7292
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\sm6fzxn3\gp1ooof3.exe
  2⤵
  PID:6180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7508
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4952
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe"
      4⤵
      Views/modifies file attributes
      PID:7660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7816

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe
1⤵
PID:7180
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\epo4jcfr\mx47xn0z.exe
  2⤵
  PID:7276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7932
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe"
      4⤵
      Views/modifies file attributes
      PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8340

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe
1⤵
PID:8488
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p4jfttrb\0pj7pxvd.exe
  2⤵
  PID:8576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xidqmmw9\1yn194lz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8200
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xidqmmw9\1yn194lz.exe"
      4⤵
      Views/modifies file attributes
      PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

0822f9a0-8223-488e-b5c4-ff5e500df28c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0822f9a0-8223-488e-b5c4-ff5e500df28c.tmp
Size 13KB
SHA256 0416bd30aa357c0bba87ed5185370a7a18f97934d3e92aa0e53820202ee1f560
MD5 4bf678b1be590dede78ae11f64103360
SHA1 066f518a394b4db4306a32f8beabd3028c1c107a
SHA512 8c3f6ac8c1f48450c7e0cc622658914293566bb0a9b83ef4e168efb9669d50bb933f6b23c071ea9022031cc4084be8be612a11553d975e3a0f3c7a2c51971067
SSDEEP 192:sxR5RCCq/fes5erDde5lSFzoD8pK4EWFAHg6+WNsws4rB+FdKO4hYBI7vuO/GWIs:sxR5nq/fesQrc5lIDa5I4ruF4hvvx
TLSH
T15552D91A59385D3B4CDBE219FA55BFA3E2F9103291E15F44ABFC861C04E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 281KB
SHA256 bbef05cf59e8a2f6220f28cdfc6dae350b847fda68766606cde5914b8d0d5072
MD5 a57d33899798a815c5cd8486ab41a38c
SHA1 19036ff4ce78c09fdb8667224bc1173abb5e98e2
SHA512 6f9598b217496e4520168b5e9b03ecbce2130242042dbe08bd58963d60b6b6c57fb7b2b35538ada1531a6ee06a20558b3f60b6e7606c0e4305b21d9c8c80e91c
SSDEEP 6144:1UWs4uMp+uTglWi2iuJQZjvmvVhJ6uv6KSBWh1YL+8:1U4uMkSCWi2Cmc66KSIuv
TLSH
T15B5423415101F9FE9DBC4C8C71FDA2640398BEB9C7F47A5D19CD1874EB0A6AB2270A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 151KB
SHA256 53fe1f285c5dc21f7b82507e518d0d2586cecf30b6a8b69e9c73b9e6df248c6a
MD5 87f61144a9fbfad2d12dabd8d8f67318
SHA1 d9d70d37b4e26ce81f7793260d67980ab284f71c
SHA512 998e9b980dce3611a728c2cf46bd8f6241d84a2e8009cc9f1de274cb8f6ff002479fdc9d9f82222f7ec85291713938b48ef96b7b6d8a40398af5dd58fd0ac2b3
SSDEEP 3072:Z4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrAMrblUdKWt3LDK4abVcRa4Xw+u:Zg6JDk3ZgtDn2SMrxWKq3LlgWF6CM8Q
TLSH
T1C5E312238D6813DC26744EE14B143E2ED69DD934C7F301A886536EEC71EAA42F7C981D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 214KB
SHA256 aee16d0ea306148a83c17886cad0422915a4453947483162d5faaf4020ac6aa2
MD5 f03377d604c5591c3a560a73108e9564
SHA1 a01a0771663f21d8652d00b99d0181c9dc6da885
SHA512 a9316f13eb0a20235e54a198d04ea3539803d0111b7ece68cf2c2c5a635c2c00d2899390ac9d40a210334647d6a50c17660668f651346f5f98c0a7102c7564c0
SSDEEP 6144:oSobZtyoq8Jd1ImfyY4ahX8T1s6eg2PRlM19xfehL:lgJd+mfX4cy17wwvxq
TLSH
T1C724234D68477D53FE417CE10DEAF402926AEB66234F97D5A613817D833703BA4BAE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 150e83da34d682da0c402aab0ef930b236a6be4a743ebb100b82546d1c731040
MD5 975f92b4ff2c3cb09e524dc9420bf6ea
SHA1 f755d1b372be5c938d048fa12dd839dda555cd4f
SHA512 75ade1410b1a002d9ae9225de0f03e181f106426bd419a39bcf5e73d2c1347148dbb632d802a27feb20013243b9daf124d732325219bc6ad431b2dd7eaa40006
TLSH
T1167185CA4366ADE9D7928875E0E4521536F2BAABC2839FC504633DF01E12F4C40FE867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5998bc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5998bc.TMP
Size 2KB
SHA256 40e496e10766f8ed8fd2e529f606d182cac4e315c347155c8b37bda83011aee7
MD5 033c1d157f226537bf23421a23ba5096
SHA1 179f2053e37ca6a61daa7b7c1fe7decbc3772cbd
SHA512 5dff602de0490c345c65b92bb23badd271e53cc4f71fd65f09de0fc30803a7e8db04ffb4fd700498bcb37d56a61470ea42695c2ddfb4c23f300e9761d42fca13
TLSH
T112513DCE5325ADE8DB6295B1D0E4511936F6B5AB02839FC048B33EF05E22F0C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 54837272d8bfdeccbceb95916ed2b3e5a3181b1c2d4764bff73efa68c6231699
MD5 3c91e05b7d836ecbe63e68e6804bf086
SHA1 41b9963775a69cdd46d8d0c2d0a50d8168f288e4
SHA512 b6f1d5ec6bf4d5e54a41d679c5d61b2cbfe398bc3b6fdd75da7621676cd1cf2f5fd967b2f87a7e239e064bb1bee3b5a33d134d89e0074e0fe58a69e49485ab86
SSDEEP 192:sxRGRCCq/fesbeDde5lSUzoD8pKDHmFAHg6+WNs+slYm9CQfYBItduO/GWIgVxJ:sxRGnq/fesbec5llHa5SHffTvh
TLSH
T1F442C81A5938993B4CDBE219FA55BFA3D2FD1032A1E05F44EAFC861C04EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eed705269990c6a49ec7f38bf11408910d0a59d4d832d78df8f47946a5d882ce
MD5 2e5e59ae9fb119e72fd19e6f8c55c22e
SHA1 d7f766b7634af4227482b721eff0e94e9d91049e
SHA512 cb91c80d4c2c08e30c547a0df3f79a61d660d8a0d05cbbfd2c95951fb2a2d648bffda2ab789abff2d50b9b3d48964fe5d1eb378315a3a907140e9dc2f34bced9
SSDEEP 192:sxR5RCCq/fes5eeDde5lSazoD8pKfnWFAHg6+WNsws4rBYm9KO4hYBI1duO/GWIs:sxR5nq/fesQec5ljHa5I4rbl4hHvx
TLSH
T17F52D91A59385D3B4CDBE219FA55BFA3D2F91032A1E15F44ABFC8A1C04EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7187ddb2bd5502a8d4eee42aa60ca42a98a7b3d21c897f2f010ece64fa0c2b23
MD5 79812cc9d1b727f91cc2b1857ed3ed87
SHA1 3df18bfe9beb4cfceb3fbe097c108fbdefa51b1f
SHA512 58b3238719beda310da5ce95554d1dafcaca76f299cb2027d845fac3a33132ded41e37bd7cb4692c3c484ddc22b5c7e8eef0d99e16a345d0c6302f8d8947967d
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhQqcHroZj:jC+vA7E7JQWgQ+f4+u1ja2VcUF
TLSH
T1BFC2EA7B640CCB7F4F800ADDED197E9B6DA802CB5698CD8047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f25b693f2e91d4f20d11b75291cbcc96639ceaa6fc9baa4e0d5d5800cd029a9c
MD5 65ee312e8cd6cc897a0d57a16e3e7219
SHA1 f2408bb4028f2dcc66295633633b311513781992
SHA512 04036054c271f5dbed1ff372b2de0d6044790d4fdde6bc93a154e8887ded6ee63e5daaaa7ef749717ffc951deb82a72f85e2717f05bffd31aff7e47bdd7a747f
SSDEEP 768:Irv+4UNbdD3qcuNp8+p3bd66j+4BRv86aLIiY2bwCl1:Ibsbp3cL8+p3Z6n4y60ww
TLSH
T1AF03CE73F9A899739CE6C644B2867A433FF851A396C10AC4D4DD2B4E419B19E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d64e6fdfda9c3414c2fb1440625340e856fff9be671dcde6ac766bbf27bb0489
MD5 e7fb2b0ed390f094b0227d142959dc05
SHA1 e8bf33da2a2db5fb0e39ba65f74d9adc7071cf03
SHA512 cc4e422b7ccf2718f270401efaa332b78daa44b2dc18c3a94c4078faa921aa0ede1608c7bab7b13835ec69fbc6f8953715b7d6235ac9b5b2ecee1c8213078ee6
SSDEEP 768:uQ3FAuWSp8+p3bd66j+4BRv86aLIWqfOuR4:uQ3FMs8+p3Z6n4yYfOY4
TLSH
T1F0F2AFB1ECA9DD334CEAD344B28637876FF8116395C45E94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 04e4556ae71091adb92723dd92fba287c0836d5a41976e30e626c9c254c48d8b
MD5 25a1a2180ef842144255bb8c0cef5ac8
SHA1 fc92a3c7b4418a50a88058d77bf74c56b7fe8947
SHA512 4fc025d0c7f4479cf07edabe8ee2aec95ad90e50ddfcad5db99e443bee32039a462179b92b626b4bd0237c803cbcca0b2ddca1b41f181751a935ed60c5957e8a
SSDEEP 768:us3FYIWbp8+p3bd66j+4BRv86aLIWqfOuR4:us3FC98+p3Z6n4yYfOY4
TLSH
T109F2AFB1ECA9ED734CEAD244B24637876FF8116395C45E94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e902fae673ba176767d8497c3248bb25e63cfdd353527b97011986e0fe7c5174
MD5 02833c52e5952d84bbed1c9cf94088e0
SHA1 756e6849fc9da6b6ed983be04294c752f8361840
SHA512 b99be1e6c3c1a7041b18cdb6a3b8756d068bf8cff91d9a38ed3f6793ddb55e00048eec9c1e314273a07c2cfb4ea44638197c4faad97898688f7ea836673bf15d
SSDEEP 768:uL3FBtMWbp8+p3bd66j+4BRv86aLIWqfOuR4:uL3FB998+p3Z6n4yYfOY4
TLSH
T1D4F2AFB1ECA9ED334CEAD244B24637876FF4116395C45E94D8DD6B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c6e4c95f7cbdcaac57c18f6e0aa19f0a39dec12ece5a16eacd70fc78b6e8891b
MD5 c649166f7d7dcca73c644aeff7734591
SHA1 73f59ebe111a571762995069a7277d3dd4bdbd2a
SHA512 ceddabe3734156ba0a346db0b4038f592e4ac57fb115a9a6c09174717d8ec70e00220fa47ec1500a48802a6a6aa801903e7cb9954dd024dc7178162fe10c48d5
SSDEEP 768:8K3c9uWbp8+p3bd66j+4BRv86aLIWqfOuR4:8K3cH98+p3Z6n4yYfOY4
TLSH
T1CAF2AFB1ECA9ED734CEAD344B24637876FF8116395C45E94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 59c4164315f780e18928e2eff45e4c1457f93d9c26d5e69e5daa6bf53d161acd
MD5 4023c7bb7286eb069acb20226511876e
SHA1 0663582d55c043e00d502350b2f9af152ca57210
SHA512 080a7dc7b2e743813b50edb486ca51d14853fda1e5482f1fec6128b150f9ecbf319ae39345aacd6cb523882b34fd91e69da19789418d599730719d5f654c6643
SSDEEP 768:uK3FBk0Wbp8+p3bd66j+4BRv86aLIWqfOuR4:uK3FB698+p3Z6n4yYfOY4
TLSH
T1D6F2AFB1ECA9ED334CEAD244B28637876FF4116395C45D94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 25cbf788f4b8b120124d061f72953144058e43ed3c20231f4d671bbe9a5b0cf7
MD5 2baac09adcbff2533480b3aba840d3b0
SHA1 fe85ce133347dc7f75e300f531c72826661340ae
SHA512 e60e3186f687cfde413fd858a91d06b0f96dec656778b798a7a37370b8f041cf85c6df954e61c13037a837a000da34762c217c66a8466ba85b5edab08868e685
SSDEEP 768:uA3FB1GWbp8+p3bd66j+4BRv86aLIWqfOuR4:uA3FBH98+p3Z6n4yYfOY4
TLSH
T1B2F2AFB1ECA9ED734CEAD344B24637876FF8116395C45D94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b3718b96bac5e01d87ade630d4f535d9802d7d9f96acdd908d6c829914ca3cd6
MD5 edb89ed31562c2b31b555d8ab86035f4
SHA1 a318b3dd178f1a5ff09add19641b02689c1c2a7c
SHA512 d219724fd397878561e581b8b715a0bf98a8ea55ee44a8ad5c082eb4906220410ae80a4736f0194c33b6dfa6e2b5a7e192aed2195aa7b3946b56f1fe72353082
SSDEEP 768:uU3FBKaWbp8+p3bd66j+4BRv86aLIWqfOuR4:uU3FBi98+p3Z6n4yYfOY4
TLSH
T1F7F2AFB1ECA9ED334CFAD244B28637876FF8116395C45D94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6f5cbde38aeb5370678e30a99f9c9022ef8500c19855bc42bd3f3e16dfd63d43
MD5 72395d664c47e05cdb439381d209246c
SHA1 a0efa09d698a65c78e62b445dec4f03cfb2b8fc1
SHA512 9c05aeeb7d47b3f53a0f534650dcde575226277f757f3070d946c4e47f5805138ad336e7c9af6816176e380d3606ce000b059b3407a03d0a707b5660f59a0aa6
SSDEEP 768:uX3FB9kWbp8+p3bd66j+4BRv86aLIWqfOuR4:uX3FBV98+p3Z6n4yYfOY4
TLSH
T1D7F2AFB1ECA9ED734CEAD344B24637876FF8116395C45D94D8D96B1D00872AE1B0B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3b384addc2406826ecadb1039a03ca888647e0eb1eaf50cda7e0f33c9b5032f1
MD5 6427ba0c85fdefabbfab617c83e5df04
SHA1 d4e53a914392ac7e45b3a540f4b26a176a28697f
SHA512 56a6f74aee0ffb442bb603c12aba8417ba9573a4e15e3caca3a1d19fea8743fe9f863f0553ff7d26dd43cd73a246e26ff056aefebcc3a605d0ac1a24d01114a2
SSDEEP 768:mrv+4UNbd+3FCMW3p8+p3bd66j+4BRv86aLIWqoqf:mbsbw3Fg58+p3Z6n4yYoA
TLSH
T18E03AE72F869ED338CF6D644B2463A837FF821A395C11E94D8D96B4D009719E2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f863789293a7666b4ca826d7ee566ae65a32e51923c05e47f214c2360c311814
MD5 46936de047a62685709050e0cf427618
SHA1 8a5dcf131ceb5a57e0e5336255c6c0a3f536b0ba
SHA512 03fdc74a47dcae2d68828eff39ed6fb064232c47c8d540bca58346d0ff552f83c8c5102dbacf8cb6421c1a3608506aa96ac462b4d0faca443189b3eca76008ac
SSDEEP 768:qrv+4UNbd+3Fz2W3p8+p3bd66j+4BRv86aLIWqoqf:qbsbw3FR58+p3Z6n4yYoA
TLSH
T1FA03AE72F869ED338CFAD644B2463A837FF821A395C11ED4D8D96B5D008719E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f6e2fdb8c393db641a41764d81246adbea073de4d20581562bcf59503d896e9f
MD5 e91c3acfdbc410bf666ef9c51a01b965
SHA1 efadde1180e4b5796dfed5083704483958d00b79
SHA512 4d27d8361ada2e121596f58a41ab8ac0d41e42c04cad00b6eedb1dd95a7ea29554ce5844548c9b258e6e2c2e97b6670aa6d1c48c9eaf1e0683c71b7c7db21892
SSDEEP 768:Lrv+4UNbdD3n2WNp8+p3bd66j+4BRv86aLITq2bwCl1:Lbsbp3dL8+p3Z6n4yz0ww
TLSH
T1AD03BF72E46899339CE7C644B1867B877FF821A399C10EC4D8D96B4E405A29F270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a9c853121377feae9d3f9f94254e820fe080b2a655242e0381f80894155ab40b
MD5 c52e5a9e778b7e8bac03e4a7177c79e2
SHA1 c0152f377a7b62bf1d031551dfd25242774b0d15
SHA512 7c2f51cd7b4069e20073c44c1e2b84a340b5020b95a4e7d69515da7c33691a814711a09b5ce5455ba7cfdf28a0f521395bb68671e1694296d70da2483586341b
SSDEEP 768:Mrv+4UNbdD3TYWNp8+p3bd66j+4BRv86aLIWq2bwClW:Mbsbp3TL8+p3Z6n4yY0wT
TLSH
T14003BE72E4689D339CFBC644B1867B877FF821A395C10EC4D8D96B4E405A29E270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 801ba0d17131fed484a80e2683a46266916f1edeab84a51e1566b83f021a7eaf
MD5 c8bd563483d28e7de2ff79a2262d3428
SHA1 d3971874b144a3e2cf28153ae3a7d08b2bca9d8b
SHA512 682db157cd11e4d9f5515eeb3e38d3ff191d1d9dba3c3d292cc029965001b4d35a7cd88a2073a703ec1d84b037bc4fb79393d0a48023fd31daac05038b6029d2
TLSH
T181E00207D31011B2D04C023101875B402B67D13003C203475E34056C7D243002C34D10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59cb93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59cb93.TMP
Size 392B
SHA256 6b23690eaba4e8c1d8b1aa6735195d0a44f16318689abbea64ca37d5e0d9c3ff
MD5 5eca59ac13e86c088437586209d6401c
SHA1 0508df2f865a6ee7b6c9474bdcf2f52f8ae7a651
SHA512 b8cf2d21de60b4dd61b6bde1202f6f392299d9d549ff69eca3c179e677db4ded4fcc298d90f64206d1690f4e5e821f989d2f8d1cd35b7c195ffb6695504ef821
MD5 SHA1 SHA512

Submit Download

ca9a1acf-f256-4b00-904c-f24bef9f3efd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca9a1acf-f256-4b00-904c-f24bef9f3efd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5930bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5930bb.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9bf5c223-7320-459f-8647-b6fc2aedc833.tmp

Path C:\Users\Admin\AppData\Local\Temp\9bf5c223-7320-459f-8647-b6fc2aedc833.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ijey1uz3.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vgquo6r8\ijey1uz3.exe
Size 5.4MB
SHA256 f972f3f0347aa9f427ebaa1f007da7e82219a333addff0c16350ff0acbb7c12c
MD5 72e3cef730653e954051afca81d408ce
SHA1 af1f79e0f7e97eb9092c87a9a13582935e1b7fd3
SHA512 4b7eed0d0d963677dbc21b9278e932315b980d2a008b010cd549d6fb8b034c2095852ba27b8581238bea1095f76917253c0a1c97e1c1473815ced69d34ff84d9
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zR5:OrICteErownP0oTcMsABqlaOzj
TLSH
T1CC463308B3E808E2FAB3D53D81665221D472B4254BB0D5CF436C9B762F676E0AE7B750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor