Analysis
- max time kernel
4s - max time network
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 01:03
General
- Target ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a.exe
- Size 5.4MB
- Sample260823-beh9es1fne
- SHA256 ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5499
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1292
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1180
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7217
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6567
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9809
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8628
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8725
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8443
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6134
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1729
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6224
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7201
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4480
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7818
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9200
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5543
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9842
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9134
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8692
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8147
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9296
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2484
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1857
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1845
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1991
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5017
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5701
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5559
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5179
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4437
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6647
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8945
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5845
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2599
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8616
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1219
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2864
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7191
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1665
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1713
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6797
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6430
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1830
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1506
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7037
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7803
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1299
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2625
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1893
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2209
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5464
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4148
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3994
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5009
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7711
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9675
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1661
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9753
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1521
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8920
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8282
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6997
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8388
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1535
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6642
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9606
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2469
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8383
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7757
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8759
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9489
-
Password
password123
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 12 IoCs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 8 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Views/modifies file attributes 1 TTPs 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a.exe"C:\Users\Admin\AppData\Local\Temp\ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a.exe"C:\Users\Admin\AppData\Local\Temp\ad87703dcbfe3701fd696f1af7388c893cb6680e6d5fa6e950a5c5a94271d98a.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffc17a0c188,0x7ffc17a0c194,0x7ffc17a0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6269401347972597478,3258919315458976251,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,2395729243816578042,4020189220905862017,262144 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,15071701149863770708,10572449810617057375,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3692,i,87816927473542263,13791688459330291272,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3700,i,17366068210948872954,10586346708009157145,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4432,i,1803302068665131564,8919673234907151853,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4496,i,16087076242615613922,5452221088122376357,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4444,i,15733545097534665165,18036008403916571436,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4612,i,15137990094647132776,3068605881748784050,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5056,i,9467363219144980820,10634222901068375777,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,17618339265506268645,5620546856102105447,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5928,i,1370405836053097787,8012513359261198191,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6168,i,6776113621192073613,9494272544953358375,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6344,i,1860925291699807208,7950508054084611127,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5104,i,9573558934725156120,5591410882303518288,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,4129993763621834281,14446610419427020064,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,4939262068601037096,10329826306164444735,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7028,i,13463318579417159632,16264359385330708260,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7220,i,14954731205286324397,12162737036028923942,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4496,i,18044976776595926549,14053696394152412432,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4972,i,5820445840752627713,789623968824562185,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7528,i,6562271424314457375,2697709436688667160,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7980,i,4574347138801332167,4775069499895306965,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8436,i,12008643849239512623,1337932585659440229,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8436,i,12008643849239512623,1337932585659440229,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=8456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5892,i,15647269191350960008,5968990318051414930,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9728 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8172,i,11579577204914009887,4444809478208346609,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5672,i,9418065742139204291,6563929640946055576,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6160,i,332585223468919867,3392834298312358279,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4808,i,3395523504880793799,10388545437945474103,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8208,i,10609330574290361892,8686989450291745630,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=3584,i,8343506090980255692,11511469246512659322,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8288,i,15994351175960089239,16982709331853370351,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8332,i,4026771905219784619,12366515827478372126,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8564,i,7130216823331032301,14259852376750133292,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5044,i,12386293681603596792,14338616665600033802,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8604,i,14773473260167578861,4378418496678182424,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8628,i,6732385945420787968,5867240987557267367,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8636,i,9692304759294466727,17545621184586597195,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9876 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8704,i,12702617679418440972,17707629743715530576,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8780,i,15317961705178892356,11999241397445392861,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8672,i,7030082809127405943,6133661205716914323,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9880 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8812,i,4690897197688531939,10061256485494656033,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8872,i,3203136881164042004,2861404687217866486,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9432,i,4015547825334957612,4418536654303938783,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10032 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=9448,i,5292380801167964042,2679462087497248347,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10036 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,16761691111100198442,17990192110296280625,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=9496,i,8167438230686660285,1250262859089447575,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9532,i,6398285605729085944,4860168645888360425,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10108 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9408,i,9660279042561281060,7296853095253550682,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9628,i,2756323797595543084,7616988791785520144,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10140 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9352,i,16450302206052680780,14202673702175600755,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10192 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9024,i,10176837802231068499,3682542577390185501,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10204 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9356,i,6278933726911540643,5541418108963568675,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10228 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9360,i,8012958636340026658,7313313833660599715,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8740,i,151348245905399348,6155272007874350938,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=9896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9276,i,12293101041714327439,646919542036890442,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10284 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9500,i,10151384091815611433,4313524261266639911,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10120 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9384,i,15456311522781211736,2639189789050341917,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10028 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9096,i,16822279559865612077,14529323374974896522,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7304,i,2943768264047893801,14434044264998021896,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=9064,i,4354420789722088461,3705235734615877488,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9588,i,4661774550519866919,16112985298463102192,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9060,i,15284827327545831775,6946190815635004552,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5736,i,6136924750015764587,9900848577563598211,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,15982411472084480809,10968078589578371782,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=7248,i,17290783757072071395,7002933407116141540,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9092,i,5666333932145733413,12166290104356332091,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=7288,i,7298104574509628091,8277760767009657479,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=6496,i,2310669658828162895,17473402181024166748,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8920,i,18306809166792517815,1393055730737491468,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10416 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=9700,i,7860713465461154097,3392892903566368034,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7120,i,834269255325233458,17576128052396370892,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10316 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7712,i,14496920671810491449,12022121966175334948,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9620,i,17254706662352154679,8516085529393619259,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,9775284046014978261,14073793869055485984,524288 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=11204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6116,i,9596480145396831339,14255744890078576566,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=11244 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=4900,i,14588900435544666409,11287586535063227276,2097152 --field-trial-handle=2120,i,5002342264150247904,8319761532061922033,262144 --variations-seed-version --mojo-platform-channel-handle=11248 /prefetch:14⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4cjsez9r\22op0jdx.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ry07wltb\k1nffsla.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yb00nmd7\7po9axn8.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\828wrhmj\rrq90spj.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ju48b1ui\4qtg0cyg.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4pzg0wvg\l6d5gt93.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ulwjjz4u\t755vulu.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\rk70ajmv\nzykcoqf.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
f_000053
the-real-index
the-real-index
the-real-index~RFe598a83.TMP
SiteList-Enterprise.json
Edge Profile.ico
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
37bcb0e6-ecca-47c2-8396-75df25bdc34a.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
36b9bd0d-75db-4bfd-8353-5b6be8be4411.tmp
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
22op0jdx.exe