d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba

Analysis

max time kernel
3s
max time network
64s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
Size 5.4MB
Sample260823-c1d29ssarc
SHA256 d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba
MD5 4ddb79bca47dbdad12ca7dfa04c935ca
SHA1 1bf5d5d708913442c7c51e7f5397dd1866bad0a6
SHA512 babe7d0d7b9358d3ffff04646804dc3e23914b4d7297790a73fe1d9dbd380c477b9c1e045992ecaa1a8391835de11dbda564483a26f90461a7834b731728d944
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMTe:9XhICteErownP0oTcMsABqlDQkt
TLSH
T12F463308B3A80DE1FAB3D13981665221D573B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
admin
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbsu0j.exe	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sbsu0j.exe	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe

Loads dropped DLL 11 IoCs

pid	Process
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\j3esie2k\\rkjvie7n.exe"	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
608	ifconfig.me
2004	ifconfig.me
2052	ifconfig.me
2781	ifconfig.me
1092	ifconfig.me
1121	ifconfig.me
1462	ifconfig.me
1539	ifconfig.me
2353	ifconfig.me
2817	ifconfig.me
374	ifconfig.me
491	ifconfig.me
532	ifconfig.me
1326	ifconfig.me
1552	ifconfig.me
2441	ifconfig.me
2770	ifconfig.me
1050	ifconfig.me
1455	ifconfig.me
2251	ifconfig.me
218	ifconfig.me
414	ifconfig.me
2257	ifconfig.me
2497	ifconfig.me
3284	ifconfig.me
89	ifconfig.me
534	ifconfig.me
1327	ifconfig.me
1027	ifconfig.me
173	ifconfig.me
1004	ifconfig.me
2722	ifconfig.me
2939	ifconfig.me
3291	ifconfig.me
63	ifconfig.me
565	ifconfig.me
3037	ifconfig.me
3161	ifconfig.me
3342	ifconfig.me
3359	ifconfig.me
424	ifconfig.me
541	ifconfig.me
153	ifconfig.me
1333	ifconfig.me
1962	ifconfig.me
2686	ifconfig.me
2834	ifconfig.me
420	ifconfig.me
315	ifconfig.me
386	ifconfig.me
463	ifconfig.me
1284	ifconfig.me
1379	ifconfig.me
1671	ifconfig.me
2296	ifconfig.me
2339	ifconfig.me
239	ifconfig.me
323	ifconfig.me
1272	ifconfig.me
1454	ifconfig.me
185	ifconfig.me
441	ifconfig.me
1294	ifconfig.me
274	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4788	cmd.exe
2336	cmd.exe
7976	cmd.exe
7376	cmd.exe
9136	cmd.exe
3856	cmd.exe
4392	cmd.exe
8700	cmd.exe
8328	cmd.exe
4676	cmd.exe
7104	cmd.exe
9164	cmd.exe
1228	cmd.exe
6300	cmd.exe
7256	cmd.exe
8256	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1276	4932	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	89
PID 1276 wrote to memory of 4788	1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	90
PID 4788 wrote to memory of 1452	4788	cmd.exe	92
PID 1276 wrote to memory of 5972	1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	93
PID 1276 wrote to memory of 4988	1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	94
PID 4988 wrote to memory of 412	4988	msedge.exe	95
PID 1276 wrote to memory of 2476	1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	96
PID 4988 wrote to memory of 4796	4988	msedge.exe	97
PID 4988 wrote to memory of 5784	4988	msedge.exe	99
PID 4988 wrote to memory of 1948	4988	msedge.exe	98
PID 4988 wrote to memory of 5784	4988	msedge.exe	99
PID 4988 wrote to memory of 1948	4988	msedge.exe	98
PID 4988 wrote to memory of 1948	4988	msedge.exe	98
PID 4988 wrote to memory of 1232	4988	msedge.exe	102
PID 4988 wrote to memory of 1232	4988	msedge.exe	102
PID 4988 wrote to memory of 1232	4988	msedge.exe	102
PID 4988 wrote to memory of 2772	4988	msedge.exe	103
PID 4988 wrote to memory of 2772	4988	msedge.exe	103
PID 4988 wrote to memory of 2772	4988	msedge.exe	103
PID 4988 wrote to memory of 2924	4988	msedge.exe	105
PID 4988 wrote to memory of 2892	4988	msedge.exe	104
PID 4988 wrote to memory of 2924	4988	msedge.exe	105
PID 4988 wrote to memory of 1240	4988	msedge.exe	106
PID 4988 wrote to memory of 2924	4988	msedge.exe	105
PID 4988 wrote to memory of 2892	4988	msedge.exe	104
PID 4988 wrote to memory of 2892	4988	msedge.exe	104
PID 4988 wrote to memory of 1240	4988	msedge.exe	106
PID 4988 wrote to memory of 1240	4988	msedge.exe	106
PID 4988 wrote to memory of 5408	4988	msedge.exe	107
PID 4988 wrote to memory of 5408	4988	msedge.exe	107
PID 4988 wrote to memory of 5408	4988	msedge.exe	107
PID 1276 wrote to memory of 2228	1276	d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe	108
PID 4988 wrote to memory of 4392	4988	msedge.exe	169
PID 4988 wrote to memory of 4392	4988	msedge.exe	169
PID 4988 wrote to memory of 4392	4988	msedge.exe	169

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
8220	attrib.exe
8340	attrib.exe
1452	attrib.exe
3096	attrib.exe
1028	attrib.exe
2940	attrib.exe
8040	attrib.exe
7492	attrib.exe
8768	attrib.exe
4856	attrib.exe
7376	attrib.exe
2116	attrib.exe
6360	attrib.exe
9212	attrib.exe
8256	attrib.exe
1164	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
"C:\Users\Admin\AppData\Local\Temp\d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe
  "C:\Users\Admin\AppData\Local\Temp\d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe"
      4⤵
      Views/modifies file attributes
      PID:1452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffff26ec188,0x7ffff26ec194,0x7ffff26ec1a0
      4⤵
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,9161038782271946061,2756436473860777961,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,8908833688932294200,9747776837709738881,262144 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,12904284187786026842,16861516305478454834,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,9982397562262037952,865931444684991977,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16217903139549387061,5930283930380011462,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,472459699786904231,13058325439659557041,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,11642007406608236698,10441442627699181571,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4372,i,12971672420369555128,12307015928054957563,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4576,i,10672366718724533688,8171460612298951295,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4012,i,9355916676636480133,12600104805026174124,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5768,i,6520877763072237330,10022477494008233392,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,9169020343354020660,8064368060879298171,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6116,i,18051416541094341214,10199431888967218114,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6264,i,9555305431040391950,10693040893647744824,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6416,i,11862888768716206286,13525455372498890459,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3960,i,9536464738939273155,4895075359421229775,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,15770808655805527126,2575777572546598963,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7296,i,15770808655805527126,2575777572546598963,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,8048222585923347216,9348229918268811633,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,10223027122043494086,13314240091873323368,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:14
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6896,i,9090992310506831931,14666549587417970673,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6932,i,11693616156729172833,16421583516032050416,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6904,i,10094148804198538356,13681482886903835254,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6960,i,17514662853047419506,13191039634371208429,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6984,i,5411266851023644951,17482678523668342834,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7004,i,8747144299927132311,9781593867397436518,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7056,i,9995478666288333626,12709230446990666511,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,10226360295981788012,16930965885864252232,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:14
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6888,i,17479720139531989159,18443903450029059911,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,949216255659057859,16862222044992018123,524288 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8644 /prefetch:14
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7232,i,11858118009262061364,6851478187344367236,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8664 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7688,i,1851934619484893027,1994642374471669470,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:1
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7616,i,2800657200765025010,8594973080319072630,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7728,i,8748024445333687693,4802999952463428468,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:1
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7612,i,14282058245754829220,14460965123471158832,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:1
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7764,i,13193717645599129941,7386028885654811576,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:1
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7816,i,9432227855634090721,4363890529553533571,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7884,i,14594009370832584563,7788043884184314606,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8092,i,13121757152024846346,4266244812950725534,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8088,i,10401314566534279975,7784957926417505214,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:1
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8156,i,13558055740052243429,4556303236005846454,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9028 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8152,i,3528300401906444740,1778290330200717606,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:1
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8188,i,17604801334750028472,5617773582203351315,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9100 /prefetch:1
      4⤵
      PID:6568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8216,i,11610496771201045689,9057818174069549485,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8236,i,16015204837600442488,10306566514099043528,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:1
      4⤵
      PID:6584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7936,i,8672647698072264614,387366782303514823,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:1
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8256,i,713185798212272448,9390633895643843843,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:1
      4⤵
      PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8284,i,2017636425389134509,2746966576095444411,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:1
      4⤵
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7896,i,2382357817804097291,1132873736489552889,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:1
      4⤵
      PID:6616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=8292,i,10404305585581447662,14756949044240568836,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:1
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8304,i,2757290059560559054,9660504794773343948,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:1
      4⤵
      PID:6632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8324,i,12958273096538271748,5119086773335070975,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9228 /prefetch:1
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8340,i,4510072668546916442,15854408411170925703,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9480 /prefetch:1
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8384,i,10843286205675106112,212998653547003818,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9540 /prefetch:1
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=5984,i,3096524858203858288,2883912578268700358,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:1
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=5988,i,384741563751939704,2857231822329206792,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9504 /prefetch:1
      4⤵
      PID:6672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=6072,i,13711717147616994802,15680355800608346898,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9564 /prefetch:1
      4⤵
      PID:6680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4872,i,9941052343582267992,1074676859804376320,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5644,i,15277826392808990435,17688848439941521355,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9664 /prefetch:1
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8432,i,15048049561755573044,5918364051191818660,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9736 /prefetch:1
      4⤵
      PID:6708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5672,i,10730390779381498783,10846824686774464441,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8396,i,12043523459752151611,361521363962006421,2097152 --field-trial-handle=2032,i,2127046317884337908,31745549438714437,262144 --variations-seed-version --mojo-platform-channel-handle=9816 /prefetch:1
      4⤵
      PID:6720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3908

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe
1⤵
PID:5092
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe
  2⤵
  PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2336
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe"
      4⤵
      Views/modifies file attributes
      PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5076

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe
1⤵
PID:4344
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xr1tt1q1\1lirworf.exe
  2⤵
  PID:200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1228
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe"
      4⤵
      Views/modifies file attributes
      PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3836

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe
1⤵
PID:4756
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nv02qkwm\eb7efbid.exe
  2⤵
  PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3856
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe"
      4⤵
      Views/modifies file attributes
      PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2036

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe
1⤵
PID:4232
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25ctut6v\s30yjn2b.exe
  2⤵
  PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4676
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe"
      4⤵
      Views/modifies file attributes
      PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3232

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe
1⤵
PID:1584
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8ecklnan\n20bgw4v.exe
  2⤵
  PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4392
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe"
      4⤵
      Views/modifies file attributes
      PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3304

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe
1⤵
PID:2768
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h1wkd32q\9y7l6hf2.exe
  2⤵
  PID:6200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6300
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe"
      4⤵
      Views/modifies file attributes
      PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7444

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe
1⤵
PID:7276
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\s90nfeoy\t3s68rev.exe
  2⤵
  PID:8000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7976
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe"
      4⤵
      Views/modifies file attributes
      PID:8040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8060

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe
1⤵
PID:8052
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bc1xjdtm\nx8xdix5.exe
  2⤵
  PID:7468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7104
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe"
      4⤵
      Views/modifies file attributes
      PID:7492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7588

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe
1⤵
PID:7924
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fuaroe14\qynm9y2g.exe
  2⤵
  PID:8056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe"
      4⤵
      Views/modifies file attributes
      PID:7376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7176

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe
1⤵
PID:7264
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3lha8zvp\ebfl4hso.exe
  2⤵
  PID:7312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe"
      4⤵
      Views/modifies file attributes
      PID:8220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8480

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe
1⤵
PID:8596
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bv6yu260\ujocow4e.exe
  2⤵
  PID:8668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8700
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe"
      4⤵
      Views/modifies file attributes
      PID:8768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8948

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe
1⤵
PID:8232
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b8u118bc\2mmnqg91.exe
  2⤵
  PID:8260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8328
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe"
      4⤵
      Views/modifies file attributes
      PID:8340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3772

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe
1⤵
PID:8944
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\prkzvsew\63c65zd7.exe
  2⤵
  PID:9040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9136
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe"
      4⤵
      Views/modifies file attributes
      PID:9212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8620

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe
1⤵
PID:8952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nk41b4vv\vob6z3gc.exe
  2⤵
  PID:9152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9164
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe"
      4⤵
      Views/modifies file attributes
      PID:8256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:8508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8208

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe
1⤵
PID:8344
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9druo6et\9n05mo2p.exe
  2⤵
  PID:8516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo9u5o41\n970044y.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8256
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jo9u5o41\n970044y.exe"
      4⤵
      Views/modifies file attributes
      PID:2116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 281KB
SHA256 38fc7a53fe5553b741b4eb08b3480d57adb1912eaac73ab7bb4b8b8c85af966d
MD5 c61a4457f8f071fc497e0aaed382d416
SHA1 8f30af17fd2495cfa617c9c5c058d5565de96f0c
SHA512 a1a1dee4dd96debbafdfbd19761aa8e922d6463c07882e78ce5dce3474b8a582a5ff7f0fab328b035c2de02445429e4e8f595710f4c3992b167621c8e14ef2bb
SSDEEP 6144:8PXR9dhPGJWp7xIrQCumRSUM837ZGZrKavj5hL:EbeJWRivrM83yXL
TLSH
T15A5422DDCC0401059ABE00589D9ED509DE2DF2BAFBCA29D7B0896B6E87016F317B3748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 75KB
SHA256 b63218ef901e29b5ae7ba642caae2ecc311b87cc60157021562ac8bf02c46dfc
MD5 a80b011760bf8025d02c325d81b9cd04
SHA1 68f1c2912419504265c4fe2a7b8eb107cd6cdcf7
SHA512 58f569e3ce4fd6c8b1f89e8c3769b0697c947577ecf5ed8f7447782365f1e06b79191eceec4e993214f863b9cf1f7226ca052c4ae70dcc86472bdffa1ce25c97
SSDEEP 1536:70r75j6HkDp2LOzT+0JN2IK1UqW8C9UUGDHNd6iGw6vaxGa43xl:70rdmTomDtsTvuVexl
TLSH
T1157302A172F2361F4756BCA69BA7D0B991EA04ED09D7B001488C3984EDC971FFA17873
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 219KB
SHA256 38099a60ec09576e1831e11a065c1f6a53cc7a1da92ebe772769df4501a2ca42
MD5 dcf251d67b6af1709572c2c4fb77fb55
SHA1 9ae867d4ceff4df4af6ff958601752e3986e7c46
SHA512 0c1bdff76abcea9f73dc3b19c0353b64a134f5b710412613a74232ed99268ff4b2a696ec7d52d6f4383e7b180a6861fcb68cd9abc6859e6e29d9b9efcfdb719e
SSDEEP 3072:Lbzi/rNmHnBtA4Xb7fgyWuF08Pz3gywjM5OBZ5H3Lb8ABAs+iJ6b34:/zi/Bk1bgoxbgywjM5O5X0AB/+i6o
TLSH
T1412422E1821223BFD258433B8BA0BCD7673B18B5C7E7AF908B89D94FD61938114571C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 160KB
SHA256 be5a967d51ac263ccdb691505da56e748126920bec3283681318ae6e69897da9
MD5 dbdda61077e6fea442136d6fe60ed5d2
SHA1 301edef721032a4dd9b0a9be7c321e905f43beee
SHA512 cbaadc00a251033bf8d66e19a3f3e0da9ab5e6608bfd0c8ff9c1205901a41326f61250e77d7f0aa81435e10387986524833d27a6b3e7633fc152ce023673570d
SSDEEP 3072:y4+S6jl1vXrTSsZM9LbcvUnteOpsPNt3Gen2FrWNoho5xtSfrIt1xJ9zLLoewpp2:yg6JDk3ZgtDn2po5xtSfrIBJ9zfZIoVL
TLSH
T190F31361E94C67DC53B8FDF20B2B2B149E69D0F846E0403865D3A5DCB8B44DA93ADD2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 204KB
SHA256 fe430c6d63b02c7f262b8c47abf6367f229f0e7cbf1941c7287a8ef89b404562
MD5 461f60671c92135b4dd4163ef782097a
SHA1 63ea35fd3ec3fff026529281f4193fb3208d4afc
SHA512 36e867e82fec1817aa05c3e89aefddaf7a620e711c98031d9f89c137a00f3c1f126599cc56b6caecfb613c88a0fbdee720f38d6000974b8fcec664b85d08dab1
SSDEEP 6144:Oj8NBNT44jE6ZCWsesNXXPSWnBYZqS0pVyWp:OANB544/JWvSHv02C
TLSH
T1B82413368125862BC1D4EFFC04D8A57837FBCD5B750252D6A7B192FA102F3C66A32D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1678121d00ee6f006bacdf4a01bf4fcf97f1d3dd3dc1393691c50d56d29fe00b
MD5 6d23257b2306cff7f465061cd59fd9d0
SHA1 339e3eb64c166aae4b02488e89f1683c80c663eb
SHA512 f75f4a969f66357e0f65021be3277baa95ce3d3a6df432a1868571b9a06a0fded1b3085fa49d11cf0afab599d905444cfb76a86c6fbf3b1c48de31f963b45205
TLSH
T12961DB1957B80CEFC76060B610E44946F7F3A69F32035F5990B82EF81A87F7910E6907
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a09a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a09a6.TMP
Size 2KB
SHA256 9c7b519b338659feab7da6cd6771c4dbe0edc39b6dfc5b35ae5dace5ddafcc7f
MD5 887c25781b633f6de7281884188930c8
SHA1 b184ac98b12ecb4c3617aa9d51ff6cc154ab0ce5
SHA512 203d984ace7302d7b96980e4f38281489b74e10330cf4f9df534e94e59de84ef32ab7c2849dc7d2db86731c7d13414b3605428e30addfb71458a1bd68a7f056e
TLSH
T1075186584B791DEFC7A4B0B110E4564ABBF79A9F32035E8041B82EF81A87F3814E2957
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dbb1919a5426d1296e2d5c47abb23e215da0293204d5f4eef93ebc46a15d610b
MD5 f3feba7fe767bbe3843c0efb37836c16
SHA1 f10f9ef88889cb857fb8daecf5f887900d757afb
SHA512 0b6d0eacbcb0fec57589c9e76f7fcd57244f99aa764a8dc5a3625f07aeab75b744b37ef274e2bfce15cac35e892f43cb7dfe3627f1adb80fa7389e15a9e42a52
SSDEEP 192:sxRNRZyM/jK1Ml8wCY/fdsyVKrjDwzoA8pKhtBFhHg6+WNslz9FDfYBROciKSGYQ:sxRNz8Y/fdsyVsAX5+jfNRQ
TLSH
T19962EA1A65389E778CDBD218F551BF63D2F95433A2941E44AAFCCA1C00E6AEC6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b99d8fb086f96730d50a0343a1de0215a0416e045b1156ea907a7ecb470fc55a
MD5 17d53a2bb68c01058031920c9e637c95
SHA1 090b14845497678b532a378214ef1366aeef60f6
SHA512 5a0f132fc727da3f1b8a0dce347a9d772720cd52d092a847420e38b0bef439f79c88d9594d75b994fb6e5bb0e062ec33599f1df15c3db2ffb741e28168092056
SSDEEP 192:sxR6RZyM/jK1Ml8wCY/fdsOVKrjDLzoA8pKAEzFhHg6+WNsETDFKhYBRocLKSGYI:sxR6z8Y/fdsOVT6X5H4hQRI
TLSH
T167621B1AA5389E778CDBD209F551BF53D2F84433A2941E44AAFCDA1C00E6AEC6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8cb0a36e7bb09015171c6a826e3fd05a3b25e273834bbed237131399a31969bc
MD5 8a231e715ad9e3cb12a50171bd1a3976
SHA1 968e0a3c04241e4a308af9afa46fcf1e11232d0e
SHA512 48d28f91e0df55def73fad873f06364a91b2192de7296127776765f60dac774b2555b481427d663f7631d7c976b63b16292677460988f0c79102e16890e5984b
SSDEEP 768:0hiiAW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkOV8iroI6A:0hiiA2E7jaWgH7f3Qu1ja3I856
TLSH
T1C5E2EB3B680CCB7F4F404ADDEC29BD9A6DD801CB5AD88D9447EA880C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 def0dd389750285ccf3d986966806a50b0e66bef41ee528d790af144088b3566
MD5 61deb9ce8603fac318e7d1466b2839ae
SHA1 4fe42d48f346a07aa51ef8c873807738c204c2f2
SHA512 6b7ad1158af090b31d18f343ec5b38dff9143ed2c5bf8adc5bda91201f0fb2f8beed32a27bf585c490b7425a48220b82ad87cf72c7a0fa5ff7fcb3d20eee4f12
SSDEEP 192:CS3eyEkUN8piiK3gY5iKxQy9H/oNJ/9d8pGNxbYgf+HPuxdQh0gS+y/2dGWWrgED:ITudYI
TLSH
T145D11400317B029138BE770895789C1EA6C2B477311AE56B7BAD15AB0F67E039DFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1edceb37e45a7379e57255058f66c908f1d62951f523d18ca4c83d81822a1320
MD5 0e2a854f1d4493bc878d7b98f63d9bff
SHA1 cf755facf0fa4bf113d2e1e3d2ee1274050649fa
SHA512 05b16e18cce872f522d37e02645c1efafec438b4d23f85e8e3b31ebbd21ae012f90ef95d052d98e9d85986a6b835bea6ede445b44e197be866af71394a72e932
SSDEEP 768:Qrv+4UNbdf39qGymDqK48dHeByERRFzjK3Y7eVH1SCj:QbsbJ3oGDj48dHSyw/hEH1Z
TLSH
T11E03CF71A9A85E734CE792897543B657BFF4412386C81BA4C5CD6F0E868B0DC530BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6ad18528fb49a76b6a6b5e60e1dfb285e50c8c658ac12d97529280c5c7b54b9e
MD5 fc623c62403b89817320a138c7d55d80
SHA1 fb19b3583a0460bff074b13a86dbe2af156f18c5
SHA512 043e32ca37519c23487a9e6636b61f9a1c9099a76c82f6c767856dcb010c2f06699897a0dc14ab4d83b061e5c59daf250eb3926ca72344653c3e8e8c1b919b11
SSDEEP 768:mrv+4UNbdf3cqG3ID4twmK48dHeByERRFzjK3JyeVH1SCM:mbsbJ3VGA148dHSyw/zEH1y
TLSH
T15D03BFB0A4A89E734CE7A249B543B797BFF4416385C40BA4D4D9AF0E45860DC170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8948996c0e4acc8ded4e2db8bf4e8216c78efb03b44623e9454e3825c0fcef60
MD5 2a02c375d982125e74c1a59c339c049c
SHA1 0aac23b56eaccf1e92d7b4e76e7ea05a6104ad4e
SHA512 d319b794e0d917e9b354f378202c0ffc1b6576f451ba433bd548949c6274f4bf6a341d525432b0e529205c1a554e798f57034324564036decaebac10f2609be9
SSDEEP 768:cn3R4qGGsD4twJK48dHeByERRFzjK3Yyf1a:cn3jGR+48dHSyw/0f1a
TLSH
T197F2AEF068649D730CABE349B6437B97BFF0417385C89A64D5DDEA0E41425DD1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3bc150526eb46ff179b288d9eee894b36b2869b0a8b86dbab8501d1b1d580cd6
MD5 7c7c6be3b2cd3b611d81921401d44ce1
SHA1 81c4f3e0db6d4cf3808d0a2859a7267b2fea9a40
SHA512 27eda28aa1826ea08cb7733032c810ea5413bee7e866f74b4b11e03bb97811bdbd4b2a6ac1c6252add8cccc9c8f6a1ce8b94be9f202cd53379ee7b054a593f9c
SSDEEP 768:co3R4qGhiD4twJK48dHeByERRFzjK3Yyf1a:co3jG8+48dHSyw/0f1a
TLSH
T1D4F2AEF068A45DB30CABE349B6437B97BFF0417385C89A64D5DDEA1E40825DD1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 12a8d70d45c2330b43ee68c436931487ab7ecb111ea9a0c8fc7731c78861a199
MD5 03814cef6b42c0c6ca9267e6998022b3
SHA1 d9ccc56ef5034a04d8914c811c6098277fefa64a
SHA512 5de44ffd2c32bb212cd77f7b76e34921945b3f1ecf7fe8b4a61cdbd2dfc9b97f121513574bb8f673bceef759659e504a21b414d5972a29ae26444ff12b421f5e
SSDEEP 768:ct3R4qGfOD4twJK48dHeByERRFzjK3Yyf1a:ct3jGu+48dHSyw/0f1a
TLSH
T187F2AEF068A49D730CABE349B6437B97BFF0417385C89A64D5DDEA0E418259D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 28a4fded41d39f756fea0b1efabd40e7632a2ad6fd80ea25f202e2aefee940f8
MD5 8b4cb441c0d3fc06d28217db141f763f
SHA1 8037b004f8c8b069c04354b9605b69b159850c06
SHA512 b4d537d83756ff09941c58f69bd8647e364809d966d6d22cd7cc0cd0cfae468a308ac99f83da2e8825d2b3ceffa76994cc3553fe599d3559322983db7c8a5c62
SSDEEP 768:cI3R4qGV8D4twJK48dHeByERRFzjK3Yyf1a:cI3jGq+48dHSyw/0f1a
TLSH
T12DF2AEF068645D730CABE349B6437B97BFF0417385C89A64D5DDEA1E404259D2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f15580320c182f2eb4cd4923ce6838c057891d809894c31754350deb26a86509
MD5 394ea351b2d169cbd518bc390cfc3b18
SHA1 d18e2379baf186dfa39c77e7ec9f6d2545ccee2c
SHA512 8ca43833765f9e6136c19b1747985a2f33900ffdefca2aead61497442e036a0fd385f5a5c1885a44a8e718033ada81aa45f3ffe3d986b07b67915533897f2258
SSDEEP 768:cJ3R4qGl0D4twJK48dHeByERRFzjK3Yyf1a:cJ3jGS+48dHSyw/0f1a
TLSH
T17AF2AEF068A45D730CABE349B6437797BFF0417385C89A64D5DDEA0E418259D2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 83521d5142db5c55a2224e45775b3fd2fb4c319a3cd327b6ab7a30aeeb86a10b
MD5 64d522f34a20764fb1ce0f92be2d754f
SHA1 085b297bc5e4f37e2a4a9a9664d89648676e30a9
SHA512 b3d912a176ac31a665deb2b70c14ef5290d6f5f320827b73b1aa2c05cb05efc017535321465c9eafb222ec1c9d82fe3538bbb8299881a2d23dee38c529429c7a
SSDEEP 768:cb3R4qGx6D4twJK48dHeByERRFzjK3Yyf1a:cb3jGU+48dHSyw/0f1a
TLSH
T1F7F2AEF068A45D730CABE349B6437797BFF0417385C89A64D5DDEA1E40825DD2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 313913144cf5f61b5b063a0ee78d213bc7e9c4487d2093bbd43fcf1140080583
MD5 6c6eee138750f55b0d0cf2d304438dca
SHA1 84a4997edb2eb0c4b0019c51f3a4e24f3d95755d
SHA512 2f8afdcec8a283f731b2b4a36b3b54fab780d2aa4cbfdc7d29d2f4c4a5e333b89ce8317523ff03f4adee2512e729cc64a2be257706e9a9babbbc9b0f28055497
SSDEEP 768:cN3R4qGxiD4twJK48dHeByERRFzjK3Yyf1a:cN3jGU+48dHSyw/0f1a
TLSH
T133F2AEF068A45D730CABE349B6437B97BFF0417385C89E64D5DDEA0E414259D1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 886f0e7456c0b9ab3b02092dc8a0f273026bc8bbd175029bd79938974839e4b3
MD5 7719ebbe5c5bf7a002bef02194660129
SHA1 45ddd14872630d759794590bf478a2bf1a5039c4
SHA512 a16ec8a1600ba796ff89374eac3a1aa8f9438fa449bed9cd42dc9b27517678fc92793460721e1330a977f3d0e500be8d9a52297bbdf1aee0df21439ce764657a
SSDEEP 768:zb364qGJRYD4twJK48dHeByERRFzjK3Yyf1a:zb36GJS+48dHSyw/0f1a
TLSH
T180F2AEF068A49D730CABE349B6437B97BFF0417385C89A64D5DDEA1E404259D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 53e720a2ee7d37236c4d75af1b24701e87447d218feb20eb5361e9df3cc209a4
MD5 6e5a141178d959e392c714c6410b9070
SHA1 ca7934cb5ffb3bd453497c4dafde40cc0dde9ca0
SHA512 a3d30b06d4e15f4f7b00889f6c66747ba147e50d3bf4f2550770dcd4f22b66ffa753144a2a3bec736b823e8b2d86cb66997613ff4c8896f7178c5557338c50f4
SSDEEP 768:zl364qGHaD4twJK48dHeByERRFzjK3Yyf1a:zl36G6+48dHSyw/0f1a
TLSH
T19DF2AEF068A49D730CABE349B6437B97BFF0417385C89A64D5DDEA1E408259D1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 10e21c29522a2172246db74ba46589427ac8da5bf4bb7ca15b954e19f959a63c
MD5 7ee88846b366e711b4f725c52e466d4f
SHA1 06c80d5cef1dfda340b69555829dde48801e1999
SHA512 3edc03e625fd220d4639ff2332774abd702609400d6dd05c8602b232d9a6dfb156dfebb65d83b7dd7b0e1ef6bc33ccb0e35871820418b97df2980b47b6872007
SSDEEP 768:c53R4qGcKD4twJK48dHeByERRFzjK3Yyf1a:c53jGB+48dHSyw/0f1a
TLSH
T15BF2AEF068A49D730CABE349B6437B97BFF0417385C89A64D4DDEA0E41425DD2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dacabfabbadbaf27b3519cb88c65add23c2a1a57b7daa964f2665b9717c3edb4
MD5 8f0649522c2e6ff13ecdf9491b8442a5
SHA1 c6a8389a278487994e5547d559010bbddef82937
SHA512 622fe0a9f5d9d7536845342b60b81aeff90b889dbe0a37c7fd24d2e6492c9e5e6d294bc42d0b797c6c3e80124bbb5540efd60fe62252f343a84095bfe9e61305
SSDEEP 768:Arv+4UNbdw3D4qGZkD4tw5K48dHeByERRFzjK3Yyf:AbsbW3NGm648dHSyw/0f
TLSH
T17B03BFB0B468AD734CA7E249B543BB93BFF4016384C44B68D5D9AA4E41874DD2B0FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fc21610c8c665a073fe10ec3e0992989ca7fbb03c4a7acfd5cb0a683dc6425be
MD5 d5e5c7535e3eb143b786367bdde7245b
SHA1 4ad7427d37db4acf81ab6cdcc946afe2ea4f5a3b
SHA512 070abf985db99e4359ee226eaf2c83e670cae044154b09616febaa81113541ee1c314cff9ffdc32e0fd5dc05c773f5d35c42b3fc5634fab50efb0a001b83315d
SSDEEP 768:cH3R4qGZ4D4twJK48dHeByERRFzjK3Yyf1a:cH3jGS+48dHSyw/0f1a
TLSH
T178F2AEF068649D730CABE349B6437B97BFF0417385C89A64D5DDEA0E40425DD2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1798e0dba8321703a9682c15efb2fe11ca72c9453f0170933ae3cf630bc96051
MD5 720ec132f8c6e9363087496f41e07552
SHA1 8556a32bdbb4825aed576b6e1d137d4fb8faebe7
SHA512 ae85766c09b1dd6130d0ec3ec47e8b7e03e22aaca578b2fa35d895adbc45c2e4927b494eebb693c3c236a795ca30a4f92bed5203ea4a6b2925f92fec7339fb08
SSDEEP 768:Xrv+4UNbdf3FqG2yD4twmK48dHeByERRFzjK3JyeVH1SCj:XbsbJ3gGv148dHSyw/zEH1Z
TLSH
T15103CFB0A4A89E734CE7A249B583B797BFF4416385C40BA4D4C9AF4E45860CD170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8b2e3836c52364225621d197967ee32bb790de9a90f8b5ad5efe15473a6dbe5d
MD5 60ee1bdb781713c92ce04bd3a1e205b2
SHA1 7e9ca16c06ea7b5a8f8634ec5fab7188ed912f31
SHA512 6c03e32cc9549b1f4e3464856dff5bc51cf98a5b946a6a89aa0292c9e5f36a12e52fc486f174022bc9d5f1d445bef64419f6fdc6b49ad341f8ec790eab48b7e8
SSDEEP 768:cD3R4qGviD4twJK48dHeByERRFzjK3Yyf1a:cD3jGK+48dHSyw/0f1a
TLSH
T151F2AEF068A49D730CABE249B6437B97BFF0417385C89E64D5DDEA1E404259D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1274372bf77a12a7c6a5cff0b70473a71e045f583f73c2f8f1cc24a16e9897a9
MD5 494da05d067456a3799a8e091457570e
SHA1 8e2e0125aec4abedea3e11043e0ec10698e75207
SHA512 8e74b23501020f24322d22b5cae9583ed610d587ac2eaa31b333e88ec3ef149a4523005d68cc17772b81149a93e613af2760e13ae4a35ddeecc74b2e25706884
SSDEEP 768:z7364qG4sD4twJK48dHeByERRFzjK3Yyf1a:z736Gr+48dHSyw/0f1a
TLSH
T18CF2AEF068649D730CABE249B6477B97BFF0417385C89A64D5DDEA0E408259D2B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6fbe7055ff6243a051bde003904b6254a89c9780afbebdad96305853bc9d0ec1
MD5 7b3dcf44f2305694f8b42a75955f916a
SHA1 839ef47a39bb9cfd6ff63c228ca34268f5f677b7
SHA512 cb8f0be751978d23a8a6c7055b75a9b2c03caa5153eea0cb1cc70fd9bc99cfba9e8533511b39d52eab3dd52f8d4114bc67a3aea595160ba58bf023b5237747dd
SSDEEP 768:zN364qGWkD4twJK48dHeByERRFzjK3Yyf1a:zN36G9+48dHSyw/0f1a
TLSH
T193F2AEF068A45D730CABE349B6437B97BFF0417385C89E64D5DDEA0E414259D1B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 01fbc28a7de722647d3cd33ecf6aade4824a381afbb712b79c84f6d383d1df92
MD5 f877cc5edd5dc73b8c6c9b22aeafd3d9
SHA1 352539d47133eccd35752ad68dc82cdfd5c02175
SHA512 b6422ca0cb437eb50acb88712fa9d02646e07e11f5ddfb8d0c55c8c68b184ec519d0cfc5acb3cc0f9078a7980f156d37613d90c899bcb59dbf3ad0ada2c48fab
SSDEEP 768:c+3R4qG6kD4twJK48dHeByERRFzjK3Yyf1a:c+3jGR+48dHSyw/0f1a
TLSH
T11AF2AEF068A4AD731CABE249B6437B97BFF0417385C89A64D4DDEA0E414259D1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a92340be6ce6570f2609be256522f9574c2a21dad37b2551a00d5fee6c224ca
MD5 83435661e3c97a641a523c51ce6ab0d5
SHA1 71be9837eb5472975b7b28ca8539c146c42beb55
SHA512 41eeb09f9f58ca57eee93aca59384b8ca0bdf1279c86db2cd6c3e797e2d11ae0d7f9738014aa22e768218e3f7e67febd6e0ee6cd31910e95f01a86c5c8fee278
TLSH
T178E00207D70000F6C05C237000832B002FA3C0B002E207875D65016C7C223001C70D20
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59e7e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59e7e5.TMP
Size 392B
SHA256 b4870955130f8c42d5435e3123a143aaa73d69e76ea31001af8522ba70e23887
MD5 0d5ae6896156bfa539e0534c47702d79
SHA1 47020e4d50997fa0ffe814b94f6927426368aff6
SHA512 2d4c945f7e71b1285151b48f722c7223edfd610580a6931dfe168f45cbd7233d90ca4ed05ab2b39b50e6ab69fb5d6606b0704fc6a064afa382efe32e159fbe5d
TLSH
T1FDE00407D70000D5C054337000433F001FD3C0F0017107C75D75015C3C333001C50510
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

2c91f531-d887-4abc-939d-0bea19fea1fc.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c91f531-d887-4abc-939d-0bea19fea1fc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\base_library.zip
Size 711KB
SHA256 cd1a56fa8a19c61e7b002a44082d85c6301f87ef0ae09e7755e4211b01e492af
MD5 2b9f1206bd687a75f90c89544f4610c5
SHA1 06314355a3fd6b0dcc3d409280fe8f6abbe6b8bb
SHA512 c066ecd31f6e97777ad2dfb80e6550f97ec90c264d28b42400d2335448ecc99c9b2f514363b1c4e1929c8483b88f770eba94d4f5eacd774b1d88807aae7e6554
SSDEEP 12288:uhVd1axhk1ibfyEFk2osQNRs54PK4I1gM5oQDS4V0cQotw:Cd1shjfyEm2osQNRs54PK4I1t5oQDS42
TLSH
T166F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI49322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rkjvie7n.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3esie2k\rkjvie7n.exe
Size 5.4MB
SHA256 d0636644aab2f52f9fa30257162ce859c67f63aa14dcc50f8799662ba6f0a6ba
MD5 4ddb79bca47dbdad12ca7dfa04c935ca
SHA1 1bf5d5d708913442c7c51e7f5397dd1866bad0a6
SHA512 babe7d0d7b9358d3ffff04646804dc3e23914b4d7297790a73fe1d9dbd380c477b9c1e045992ecaa1a8391835de11dbda564483a26f90461a7834b731728d944
SSDEEP 98304:NWgtXhICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHkZMFr6kMTe:9XhICteErownP0oTcMsABqlDQkt
TLSH
T12F463308B3A80DE1FAB3D13981665221D573B4254BB0D1CF43AC96662F677E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads