Analysis
- max time kernel
4s - max time network
63s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 02:12
General
- Target 91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400.exe
- Size 5.4MB
- Sample260823-cm66wsdn4s
- SHA256 91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7860
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4338
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9013
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6563
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2325
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6868
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5708
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4380
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8405
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9292
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3871
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7123
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1349
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9933
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6991
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4721
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5718
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4625
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5871
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6379
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8181
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3754
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6397
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3936
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8583
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7518
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3437
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1289
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3949
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3011
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7879
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3043
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1977
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3834
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5817
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6714
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8843
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4716
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9885
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2483
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1670
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1505
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3610
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5858
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9014
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3412
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4108
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3611
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9237
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9907
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6025
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3984
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6125
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4191
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3271
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5711
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6475
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6143
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1406
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9242
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8261
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3942
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7101
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7973
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1908
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1442
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9744
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8136
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1909
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7065
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1029
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3555
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2920
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7001
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2333
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8459
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6596
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1288
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3036
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9878
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4212
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6128
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2785
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1572
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5815
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6327
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7903
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5726
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1887
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2313
-
Password
password123
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 11 IoCs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 35 IoCs
- Views/modifies file attributes 1 TTPs 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400.exe"C:\Users\Admin\AppData\Local\Temp\91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400.exe"C:\Users\Admin\AppData\Local\Temp\91d4c34d2400a3fdb47dacd34740de0e2b24cadcb3fcc129679a952aabee0400.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffda539c188,0x7ffda539c194,0x7ffda539c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,17934686444631098845,6553546830396208224,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,3910655479658131797,10874725726801964739,262144 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,11134541500144740353,8051872190741040742,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,5884419279142201825,17520545626426227525,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,8906329705016083439,17387931447423633268,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,13673216930912468057,12595671521120783291,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4388,i,16770668393859410517,4939390253731015058,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,15992279000190787864,3317917992086954780,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4764,i,6932958619004277734,1319157701666238749,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3912,i,10152821039353873208,1219898506534622702,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5692,i,17479166456682744019,2541912862592226865,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,14727232130810883554,2998409179307904979,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6104,i,2215338386646761523,8509024574638339364,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4764,i,10834147345172795183,12166370168722624155,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6496,i,7917674741972969875,8129004489579942308,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,13844638667952750793,6805353052886233664,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,13844638667952750793,6805353052886233664,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,9509203065039067335,17567233230360174166,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11696437738419482733,13188389492455055649,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7264,i,7167813550335584667,8668766468538433171,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7308,i,3881417125981932116,16408950124882557331,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7324,i,14499042767960604759,5477315732956297834,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7360,i,3445289890925146159,4870458204709183720,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7388,i,14152773729227766218,6612742435862020034,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7448,i,7839541237829274545,13972377845037871667,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7416,i,17871964404696979409,4664497292423582306,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7504,i,9403187366718312071,1565084041856240379,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,6200270833270361679,6526723607956301910,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,10645595760577237569,5053189225089036745,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5792,i,10397341809218504745,13209146470158996086,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6016,i,10903959600328249465,9376119942231584333,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8132 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5956,i,14182429286060263690,5410689124815888058,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5992,i,4210432257167435271,1125896618130797930,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5968,i,8723486696062463304,5430467898949434668,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7876,i,18193377024422065787,4765363225163528993,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7912,i,11317976579375883607,9361331070115729822,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=4864,i,13335482716478819142,8255388458053715026,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8004,i,17677623427241222389,2288575468732066118,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=5152,i,8618718353936868123,4241749320232929602,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7900,i,14777501621624297477,9562162354288351932,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5980,i,15565977337524960528,13948255187486835919,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7760,i,12430771124511776034,14583846720521076189,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7804,i,13579627928777987150,47175690466406821,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7936,i,13029045725737908057,3873241814583939847,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8740 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3884,i,13587161788096187449,10892978265280074926,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6060,i,12855065233266537666,4247919670769844089,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5608,i,18226063568847970001,6845123104544684557,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8072,i,14436610117656871591,16390724282415729562,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5112,i,9263291683667994352,2100835558505522379,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8844 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5160,i,17240247142669057240,4205467884348926245,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7836,i,4505375172797727689,687757706082532792,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7940,i,12338253264497139972,5880526954375922061,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8184,i,12325158697823741112,9037271049699595204,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8356,i,312678692252105023,6896585864574532179,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=7960,i,1342964992361633134,7802331069923531359,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=8328,i,2602711969272454394,138897778906539851,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9128 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=4568,i,15241834431742632561,5289862337000784440,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9080 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8080,i,1280510224056235791,1987611085363215296,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9012 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=4812,i,2558356880779063899,7273306488964283338,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9060 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8212,i,181542622414539419,3467631691495474685,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=4828,i,8986861953090189119,14627787826228372820,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=9020 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4776,i,13859094126160773396,4191785854562886950,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=8972 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=10208,i,8482388322036140503,7658078119736738992,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=13884,i,1044286068792698297,15085264796738555834,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=13948 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=7336,i,8347173652591700308,14790120312011415685,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=14432,i,273807626815659706,18346470629626236801,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=14456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=14476,i,8403645933625189323,17466741168409454288,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=14388 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=14768,i,17686934258748759034,15752533563422379139,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=14716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=14392,i,2324351352375461670,2316542838069906624,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=10160 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=14956,i,6842056810423584663,17938895668437976362,2097152 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=14948,i,8984215497394910976,16256157028198452714,524288 --field-trial-handle=2224,i,13298474403832635730,397548022846643867,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:144⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\i0ic903o\qwnbzysw.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0ei38z57\szeuki2u.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kjfjlat9\jqaqcms0.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdxdaj86\soiteel1.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ht8nf7sx\qzrkwpvf.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\81xu6tfq\gf3mlcl2.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\az0hwur6\g06mw7zq.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anlzzdsi\zblb3e36.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1nk1k2kb\i8av0fqn.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h3hk96rw\tx1aa74z.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cn4emcgx\rtk8aou5.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3j83wuc7\5fqjaszj.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\601a59vf\7kgwlk8h.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\601a59vf\7kgwlk8h.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_00007d
f_00007e
f_000082
f_000086
the-real-index
the-real-index~RFe59f90c.TMP
SiteList-Enterprise.json
Edge Profile.ico
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59abc7.TMP
9483a740-ec25-4d2b-bd0b-becd182908b1.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe599292.TMP
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
a77ae1b1-4de6-4cd2-be58-f6c8cd6ff48d.tmp
qwnbzysw.exe