a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d

Analysis

max time kernel
3s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
Size 5.4MB
Sample260823-cpb4jasaka
SHA256 a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d
MD5 677c5b541104006a7bf0c303ac00f561
SHA1 32505746bd355d6dfaa7f0a1ab1a720e1c1e157a
SHA512 e9131e2ad139b1fddbc06343244c65d828329ce404f122c90e795c706864396097d122310c52148057d30eba200ece62ec233bba8dd318b19de47c5f55c7f1fc
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6u7:AsTICteErownP0oTcMsABqljkM
TLSH
T134463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4992
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8385
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8747
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9843
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6804
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3966
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5573
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1199
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5841
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7312
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2262
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6034
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9437
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2176
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8474
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2192
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user7113
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8901
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1624
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2917
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6401
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8617
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6715
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3411
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5991
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6882
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6651
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8329
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8488
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6057
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6613
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6709
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9204
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4816
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4607

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2644
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2614
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2408
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ce66as.exe	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ce66as.exe	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe

Loads dropped DLL 11 IoCs

pid	Process
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\e2l8f2xu\\2t5j1pd2.exe"	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1494	ifconfig.me
1658	ifconfig.me
320	ifconfig.me
380	ifconfig.me
412	ifconfig.me
1888	ifconfig.me
1944	ifconfig.me
2495	ifconfig.me
3100	ifconfig.me
3263	ifconfig.me
156	ifconfig.me
340	ifconfig.me
446	ifconfig.me
906	ifconfig.me
1685	ifconfig.me
2286	ifconfig.me
103	ifconfig.me
126	ifconfig.me
497	ifconfig.me
957	ifconfig.me
1062	ifconfig.me
1796	ifconfig.me
1882	ifconfig.me
3149	ifconfig.me
421	ifconfig.me
1233	ifconfig.me
3301	ifconfig.me
3598	ifconfig.me
243	ifconfig.me
268	ifconfig.me
344	ifconfig.me
480	ifconfig.me
831	ifconfig.me
908	ifconfig.me
84	ifconfig.me
116	ifconfig.me
661	ifconfig.me
715	ifconfig.me
857	ifconfig.me
942	ifconfig.me
2750	ifconfig.me
108	ifconfig.me
284	ifconfig.me
485	ifconfig.me
680	ifconfig.me
1192	ifconfig.me
1208	ifconfig.me
2462	ifconfig.me
2634	ifconfig.me
495	ifconfig.me
820	ifconfig.me
1676	ifconfig.me
2265	ifconfig.me
3091	ifconfig.me
3159	ifconfig.me
435	ifconfig.me
337	ifconfig.me
911	ifconfig.me
1414	ifconfig.me
1717	ifconfig.me
926	ifconfig.me
1552	ifconfig.me
3647	ifconfig.me
77	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4168	cmd.exe
4880	cmd.exe
5608	cmd.exe
3980	cmd.exe
7112	cmd.exe
7732	cmd.exe
5704	cmd.exe
2020	cmd.exe
3304	cmd.exe
8496	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1508	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 4356	5164	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe	89
PID 4356 wrote to memory of 5704	4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe	90
PID 5704 wrote to memory of 5744	5704	cmd.exe	92
PID 4356 wrote to memory of 1508	4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe	94
PID 4356 wrote to memory of 4396	4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe	95
PID 1508 wrote to memory of 3140	1508	msedge.exe	96
PID 4356 wrote to memory of 5640	4356	a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe	97
PID 1508 wrote to memory of 244	1508	msedge.exe	98
PID 1508 wrote to memory of 2560	1508	msedge.exe	99
PID 1508 wrote to memory of 2560	1508	msedge.exe	99
PID 1508 wrote to memory of 2560	1508	msedge.exe	99
PID 1508 wrote to memory of 5988	1508	msedge.exe	101
PID 1508 wrote to memory of 5988	1508	msedge.exe	101
PID 1508 wrote to memory of 4596	1508	msedge.exe	102
PID 1508 wrote to memory of 4596	1508	msedge.exe	102
PID 1508 wrote to memory of 4596	1508	msedge.exe	102
PID 1508 wrote to memory of 1456	1508	msedge.exe	103
PID 1508 wrote to memory of 1456	1508	msedge.exe	103
PID 1508 wrote to memory of 1456	1508	msedge.exe	103
PID 1508 wrote to memory of 1308	1508	msedge.exe	104
PID 1508 wrote to memory of 1308	1508	msedge.exe	104
PID 1508 wrote to memory of 1308	1508	msedge.exe	104
PID 1508 wrote to memory of 2916	1508	msedge.exe	105
PID 1508 wrote to memory of 2916	1508	msedge.exe	105
PID 1508 wrote to memory of 2916	1508	msedge.exe	105
PID 1508 wrote to memory of 2964	1508	msedge.exe	106
PID 1508 wrote to memory of 2964	1508	msedge.exe	106
PID 1508 wrote to memory of 2964	1508	msedge.exe	106
PID 1508 wrote to memory of 2852	1508	msedge.exe	107
PID 1508 wrote to memory of 2852	1508	msedge.exe	107
PID 1508 wrote to memory of 2852	1508	msedge.exe	107

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3444	attrib.exe
4872	attrib.exe
1668	attrib.exe
8460	attrib.exe
5744	attrib.exe
3380	attrib.exe
4740	attrib.exe
880	attrib.exe
7188	attrib.exe
8868	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
"C:\Users\Admin\AppData\Local\Temp\a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Users\Admin\AppData\Local\Temp\a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe
  "C:\Users\Admin\AppData\Local\Temp\a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe"
      4⤵
      Views/modifies file attributes
      PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x364,0x7ff844bbc188,0x7ff844bbc194,0x7ff844bbc1a0
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,7042215182168322057,15522490308378701568,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      System Time Discovery
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,8504698146493011749,13093930295938857309,262144 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,5139263245721739930,18397349525925579458,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,8500884385569213769,596699531452174903,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,1794224570645319402,17665228712814838565,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11190468339628110586,3474780936520882780,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3751861287111425272,11076810416030214563,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4384,i,12225834825740846644,7185821678545281894,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4640,i,12134923133372756530,3291964016608245866,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5572,i,1147892228742063551,12582235745662856313,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3908,i,17362826380307147666,3394063219018898836,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5314295798473622833,16985365178446285540,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6056,i,18369131709553371983,1786951441676376340,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6252,i,10731098767279727207,3176867486430474175,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5584,i,4004029561545483399,3947536504044500946,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:1
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,11293891350668655414,13922005599524031052,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,15622634516772764494,273703705741229953,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,15249021547875737063,1128748344514230012,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7856,i,15249021547875737063,1128748344514230012,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7272,i,14904787679426223994,2466689990434387569,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7312,i,5287455623211337185,5960742192356772608,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7328,i,5328277291587808183,1484746329064682416,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7368,i,9750456352491470745,705528874129330133,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7376,i,59609241427486821,14004695830917588987,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
      4⤵
      PID:6168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7456,i,3168757598615650229,11087336206705772422,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7404,i,8671690401689252037,3669818974835801655,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:1
      4⤵
      PID:6160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8016,i,2084291007689934462,10047484675918438741,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:6184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7516,i,5741606738313779528,1262362637326344710,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
      4⤵
      PID:6192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8032,i,12856125735313230482,3201964152154673170,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8048,i,9563344308425696534,633436998235556471,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8104,i,13980567518837099736,14405436612735687497,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8060,i,4093109593454116211,7563670011780763841,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:1
      4⤵
      PID:6232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8124,i,10603509006957970680,4903031750844874658,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8788 /prefetch:1
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5568,i,14408261219117600798,12169849120047121805,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8864 /prefetch:1
      4⤵
      PID:6272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8488,i,14571592160629315348,13834332918232004232,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:1
      4⤵
      PID:6256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8376,i,12892878265398408845,53905459581906956,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8904 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8188,i,1887034331959854055,275994553542615746,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8804 /prefetch:1
      4⤵
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8208,i,3231099605145394773,3000795692557029218,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8152,i,12357925549492416455,9742669840790838103,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8324,i,16620592487630755686,3879528606615554046,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:14
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4924,i,8206969171566325833,15104327020629032432,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:1
      4⤵
      PID:6312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8496,i,1462647049989882638,8987301309343764356,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7792,i,11235946626536425138,6981438416991438745,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=4804,i,12351768133779101117,11218099848655033266,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=4896,i,12850679147330687707,6123051505972651989,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=8992 /prefetch:1
      4⤵
      PID:6320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=6028,i,3965322635917222890,4590173827112226735,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:1
      4⤵
      PID:6328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7796,i,16485054947609632098,740579554269673815,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7744,i,16450457942580431358,11625608630865636691,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:1
      4⤵
      PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5908,i,4151528859306956778,850506123742299581,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9180 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,16741812561286821921,5318382139669171308,524288 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:12
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8576,i,7660065554435754166,14613152159299205813,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9364 /prefetch:1
      4⤵
      PID:6392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=7740,i,11265336555089412982,3866658007756737817,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9380 /prefetch:1
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=5964,i,13865965332118419638,689481802561671030,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:1
      4⤵
      PID:6368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8532,i,16004497008467151233,16232521876198666058,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9488 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5996,i,1938093720713087813,6277457949790232935,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9268 /prefetch:1
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8548,i,9987578703369852658,942676246665809318,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=5924,i,5588228545064895585,8361435092568023075,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:1
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=6004,i,4686501427413193021,12849831491166722615,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9552 /prefetch:1
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=8632,i,5085873393087896636,13991965585288502909,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9532 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8680,i,7607907209196612908,3009843728924779013,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:1
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=5932,i,8933143867768508268,11225583433721051221,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:1
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8620,i,1974174554195969613,10855941366383525169,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=7764,i,12264536403650408621,7633807702068518672,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=5928,i,3508522134443334506,9099778663462336414,2097152 --field-trial-handle=2300,i,10492332226511540515,11273249904300173533,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:1
      4⤵
      PID:6480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4172

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe
1⤵
PID:6044
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe
  2⤵
  PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4168
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe"
      4⤵
      Views/modifies file attributes
      PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1192

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe
1⤵
PID:4520
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vdkvo5id\im7zxxxs.exe
  2⤵
  PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:2020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe"
      4⤵
      Views/modifies file attributes
      PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5828

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe
1⤵
PID:3224
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yq5y3zk3\p3gyvd62.exe
  2⤵
  PID:4100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4880
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe"
      4⤵
      Views/modifies file attributes
      PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5344

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe
1⤵
PID:628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6qsfsxl0\99eyj554.exe
  2⤵
  PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5608
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe"
      4⤵
      Views/modifies file attributes
      PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1764

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe
1⤵
PID:1192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qclo16tv\xlbz8tkn.exe
  2⤵
  PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3304
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe"
      4⤵
      Views/modifies file attributes
      PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:720

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe
1⤵
PID:2476
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\anaieq1t\lk6v53mw.exe
  2⤵
  PID:3784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3980
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe"
      4⤵
      Views/modifies file attributes
      PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1132

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe
1⤵
PID:8520
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w8rpvvuf\sfzz8kom.exe
  2⤵
  PID:8764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7112
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe"
      4⤵
      Views/modifies file attributes
      PID:7188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7972

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe
1⤵
PID:8952
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvnnmo2r\7fw6wp0u.exe
  2⤵
  PID:8604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7732
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe"
      4⤵
      Views/modifies file attributes
      PID:8460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8612

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe
1⤵
PID:7192
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\njjf6609\8mt3fq1o.exe
  2⤵
  PID:7328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8496
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe"
      4⤵
      Views/modifies file attributes
      PID:8868

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe
1⤵
PID:8480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v0vjab5q\80507k9r.exe
  2⤵
  PID:8716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00004a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
Size 281KB
SHA256 38fc7a53fe5553b741b4eb08b3480d57adb1912eaac73ab7bb4b8b8c85af966d
MD5 c61a4457f8f071fc497e0aaed382d416
SHA1 8f30af17fd2495cfa617c9c5c058d5565de96f0c
SHA512 a1a1dee4dd96debbafdfbd19761aa8e922d6463c07882e78ce5dce3474b8a582a5ff7f0fab328b035c2de02445429e4e8f595710f4c3992b167621c8e14ef2bb
SSDEEP 6144:8PXR9dhPGJWp7xIrQCumRSUM837ZGZrKavj5hL:EbeJWRivrM83yXL
TLSH
T15A5422DDCC0401059ABE00589D9ED509DE2DF2BAFBCA29D7B0896B6E87016F317B3748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f0da9cd3efde283cc229a9b09a41d18e144dae59768a513ee23d6cb926352f4
MD5 838041291fd7ff35f044af1c21a95e17
SHA1 40a5d001e8ade9d97f61435ee41b27d9cc3086fa
SHA512 b27b8b92b06beba0286f5ebd7e7b69f17364693af47bdc895ed0ee937994926d4593daba7cdaa873988d0ca9e8105f79e7ad0a5707a62ea53b8904a1691ea712
TLSH
T13A31BEF3C6E85A3D894146F87B153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5175251762b2db7cf01ab8881e923da97a61aa5b1d4a1d402760281ea7d205c9
MD5 ee35bbb9c281ae1b12c24838e0b86f6b
SHA1 7713dcfa35a351042237fe49877b142d2acfb2ef
SHA512 3b1784765692172e6ab3036689ee42b0ae58c7733ef07cdbb6ac86dbed4aae01ad3015718435be32a08b007af6732f22276125c74b0cf5e26fb0496336d19ff1
SSDEEP 192:sxRxRsCR/fVs5EXDde5lS+zoD8pKUnHF2Hg6+WNslT9zxfYBxAluOtGWIgV/J:sxRx9R/fVs5EXc5ldzY56rf35f
TLSH
T1EE42C8165A289D7B4CC7E219FA15BF53D3F55032A1911E48EBFC862C14E7ADD221B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3746038e02253c9cb6fa373f0bea2c4d2e1ff797dbdc9ffb365dce27fd7cae93
MD5 14dacd0ffe9e6e3980c017c2f69b74b9
SHA1 cdb2228e8ee697a7f0b19fd0e5c3c57de1dc84ad
SHA512 aebe502df8b7bb36183bf297e3354e48314410237d69932cb745b068a421d3fecfe609fa29178d7d8696fd62cd2fffc0ef2194d1618ecb3c09a8c370cc11fda8
SSDEEP 192:sxRmRsCR/fVszEfDde5lSszoD8pKrU6MF2Hg6+WNsrBDrp9yYJ6Y/YBx6HuOtGWT:sxRm9R/fVszEfc5lbjY5uxL7/b5T
TLSH
T1DD52DA166A389D7B4CD7E218BA15BF63D3F5503291D11E44ABFCDA2C10E7ADD221B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8d85220cf00d66d657facb5d4ed8547aa633192b039dad7e92895a2d669f6af0
MD5 ccd4b5185a820a52ddec208252d34ddc
SHA1 f8d169500e5e8aeb44a69506492bdd7da15d789d
SHA512 905424bc207fe9664438510d56b5211339a4e205a5149e4555dfbec3f51780c7d2fe3c1452a047ad8108f8625391567374b6bdc01f2b442a80d470734fb14193
SSDEEP 192:sxRmRsCR/fVszEXDde5lS7zoD8pK/w6MF2Hg6+WNsbpFrp9Earz6Y/YBx5luOtGY:sxRm9R/fVszEXc5l8vY52TTrt/K5T
TLSH
T1DB52DA166A389D7B4CD7D218BA15BB53D3F55032A1D11F44EBFC9A2C10E7ADD221B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3c45fc62b58b3f1bed908820205d352f8377ebac213bf9dae0887fc8e4e88c8b
MD5 2df81b703fb911ec336f518412a98a97
SHA1 7faa18ad8095e7954ad40b8f9e1e663c987d4a4f
SHA512 5300443cb11b3ec2ef2747811b0fe7e337df842a0e0df2dae034c6e8a88d663066be8085528df1831e71ce8eedbb8b39949d2d3c726574fbca2475681312da2b
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OViQqcnroZs:jC+vA7E7JQWgQ+f4+u1jahVc0i
TLSH
T12DC2FA7B640CCF7F4F800ADDAD197E9B6DA802CB5698CD9047FED41C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\57a07ad9-fda8-4f81-a686-9e760b838668\index-dir\the-real-index
Size 72B
SHA256 d2a48139c593197e428db3fde9351c5b91062dd6e234c9bfeba3ba9568731c96
MD5 400e172715ddd3cd55b80ab3920b4ca4
SHA1 05ce0654f25aff971bbd75dec03906ae7c556ffd
SHA512 63824e07e2463dec03df730679c9bb8960b2482895bf19a2f74955ad3cd285e5f268a70aacc0423e12683a0285650362e6d66bf42b6a32038a965e9b0f29e2a4
TLSH
T1F3A0022C439C7411C06E87B028461140A2A1AD140102172154D918669AB2255550E454
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a687.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\57a07ad9-fda8-4f81-a686-9e760b838668\index-dir\the-real-index~RFe59a687.TMP
Size 48B
SHA256 cb45596e7b39716a638f7ee4a3d7fdc102860b0a7a48eabacc205096cd706841
MD5 66c91e14ccea698f1be3b2966868bab2
SHA1 39c710eb48f080c8349a1880660aac843e2f80a5
SHA512 50f2f0330c66184dedb4160a16dc2adc20b7c8a9ef555060cd287c62417485f87fe8de1d2fb4388ec94bf8c17d17550366a3f2c02bb06a4d9ec5d178fbac7715
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 116f80441ab158a7ba32d355250dd3ebcb3154180d9ff50d8c4c1f5d6207f499
MD5 f16c19dfd0cfc3067bba4b7ff7f83f41
SHA1 17e34a20e78f2d73beb2049db0ae27e95988e6b2
SHA512 7de4cdeba565bfc4951491661dc950ce2c0fd4011f91e01eb5e3cf5124ac36fa8cee76a3c7969d24a894acdc5d66ae5cab98143d88af7231992d2bf778184b58
TLSH
T1D0C080731265D1105E708DD070BF62309D661484E8E186C7E41161D80D304520465F77
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a6c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe59a6c5.TMP
Size 165B
SHA256 06c96413b049b8d409b3800d2c0cd6aec2e2cd811c1772c400658251e913b5ff
MD5 71866d98631b7bbad5ecf8847c0cda0e
SHA1 49433ed9302505c006c3a74105ebd98d9555adab
SHA512 37b8149fcd715c7862ebcdeb8fa3a4b990773994b9df70edb5c698f741c4280b8af19686984b6dffade5ca52d135eb42750d90c04b72afc01a784c3f05ec1a4f
TLSH
T1EEC08073127591145E704DD070BD53209D761C84ECD186C7645131D809304530458F77
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 040b0af8a95af11336cb108877b5224fb1dc0391f6fbae8fc1789b8996feac2d
MD5 2b1dd19d1ad2c21fbf82b9aa2b819900
SHA1 825b0f11eda3cd0d5d1b013ad62d5b094d13b926
SHA512 67ae7b3bc3fba5cd63744559c6ef4725ef49825686ce76fb1d5ba5036d652562e0bfa9da16b813e2ec7fa553c16034c4e1a39be69a3c200c6299700ac503affb
TLSH
T1D6D022684E49C341CC02C7306D62E0CA7335C9E8C90F566B803C309F6EE30324F82106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a648.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a648.TMP
Size 48B
SHA256 009f5a7b3424723f7c8f0500e707d10411742e12620eea8cf30ca46190e7538e
MD5 3d293b3870dbe8a5f3efffacca0b64d3
SHA1 26b145530369b9ad34d7615fac302144012556ac
SHA512 95f157df1536ee8a616d60598208d957852b3d1331f3d61497d519e1a958e3538c90b85fd876b1152ad420ece32f594171fa9a93a3303f5cfd26efd06e24d95c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 12bb504dc835390649f3efd25bf7c80448103229f11ec364f938a58f6c98d2a6
MD5 beb2f0c837a5f19723c652ab422c17b0
SHA1 9d76e9ac8f615fb915256bfaf4b78b164a8c4617
SHA512 c945e0bdd7512da3712bf5dd52611ccca6ef8bd16d201050ece172925914265ebe0d5e3b01448dbfa6fd2364f516310b8ee86127d5dd775170851258713be007
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8s:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEx
TLSH
T1C7913210313B02C0383DBA5CC1B99C6A86C174723416E56B3FA945AA1F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 20dc11ba6be6c82bdf567f3136b6c3859db34192a608406e689d96439bcd4fc1
MD5 b8f71cd73ff1892549f0f3310908f43e
SHA1 e9cd818f14756029248e547b227ba375ce1718f7
SHA512 0aabcace775138e49963615cacffc4d08858957af86d68b162eb516704cd319ecab1c906a80b7a72b7ebf6d941dd4a54b1a34f71baf68403f52f9c350be4a606
SSDEEP 768:Irv+4UNbdD32cONp8+p3bd66j+4BRv86aLIil2bwCl1:Ibsbp3kL8+p3Z6n4yT0ww
TLSH
T18B03BE73F9A899339CF6C644B24A7A437FF851A396C10AC4D4DD2B4E419B19E230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5ae52136c08a9da92aa0e35df35a58118ec809d2281b61255ec37ee727bb104a
MD5 ca02e0eae035ded554334f89d47a37f2
SHA1 d9db4de6a970c0c876d02be6bc705a31c768570b
SHA512 3d8f4528123ba2209d6020d2362e062d963caf65889be13645b6014df47895fa375866ab58f65ebb71f5531603241254cefd5fda6f7442378ce7bf3f6689cb6c
SSDEEP 768:3L3R64rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3L3Jd8+p3Z6n4yIfz7w
TLSH
T1D4F2AEB1E9A9DD734CF5C348B64637436FF4606396C41E98D8D9AB2D005729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 97f23dfd49c795362ead473403852e78ed60a0bc0056cf6c5f24fd54ed54d851
MD5 fc5792b871a77a76fc0ac973abaa8edb
SHA1 47ce9208b9a09ba111346f251b0b2cdc5d17bf70
SHA512 2141b3202c6b81b3dbc12ab0125e95fb27b15a3e83ae590711da0011be098b411cc1674123a3dc8eeda11209318c7352e0c00c3837e1a2f29ea7c5cc52647eb0
SSDEEP 768:jrv+4UNbdD3qK4rTNp8+p3bd66j+4BRv86aLITm2bwCl1:jbsbp3YL8+p3Z6n4yz0ww
TLSH
T10103BE72E5689D339CF6C644718A7B837FF811A399C10E94E8C96B4E405B29E370F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 66799ea368e0733a2a06e66d18ecb3ddf92c6367ce7514eaa1ab08f3c3d8f0f6
MD5 0fc092079167e970c81c059054345eea
SHA1 15f7790a3f25a3d933ee5358151b67f31fa983b2
SHA512 8659a8c2777d816fcc58db46434928081b134aaf9b0de623b779255198220a84d70f8ef92e05b10cb50c31df40ce581112e2dc76c335982eeebea17cc835f592
SSDEEP 768:hrv+4UNbdD3Lc4rTNp8+p3bd66j+4BRv86aLIWm2bwClW:hbsbp31L8+p3Z6n4yI0wT
TLSH
T13003BE72E5689D739CF6C644B24A3B837FF811A395C10E94E8C96B4E405B29E270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6ad86484087f628dc5987100211d9d15136a9fa0e9e8556ef8873876d611b1fc
MD5 a41137758da9bc6b6cc188c67d5f7cfe
SHA1 51b0a5d8ef36ebf782a51b98a292ceedb02763e3
SHA512 bbdce7ac22030618a29d4ef6cdbbed8c1fd2a22072e221979b92e11f217652d53c1140ceae3e13e8debf2859474516a8a9edd31eca8e6b5df7ea203fbbb3a27a
SSDEEP 768:AQ3aO4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:AQ30d8+p3Z6n4yIfz7w
TLSH
T15FF2AEB1E8A9DD738CF5C348B6463743AFF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a318addd044c2df5ddf0342c736514552998b3f260aa8df25c095e86737edf32
MD5 c6dfd4587b6c7dd6ebfed373bbfcb39b
SHA1 207c8b73f0648e25e82f129a4115ce9dd5b476c5
SHA512 089179f67c31e4d72ceb60d314cbcc8a764c091d322ad4bf8c49de338bc6e47630c164c22f6c11df8d0f5546e97a57dbb4c0907f07a7036fa635db3e2471236a
SSDEEP 768:3v3Da4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3v3Dd8+p3Z6n4yIfz7w
TLSH
T1C5F2BFB1E8A9DD738CF5C348B64637436FF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 84db6c4f6c51598c4044769dff9de5b8af511e24c08e0fc30643bc758470bc87
MD5 ce370177fdaf0c90a9feef295bc37299
SHA1 cd9b6e6376e551e3cba6e8bd6c9b816d3481a3cc
SHA512 f2bf516bcf0ef566b8517d18facb5a3ac28b2bb8d6b7005856cb2a3a3c64ed4f4835382eec2e63c8db2a47c87445187255fbba59df508bb810040c940692f290
SSDEEP 768:Nrv+4UNbdV3ls4rTXp8+p3bd66j+4BRv86aLIWmoU:NbsbL3XZ8+p3Z6n4yIoU
TLSH
T1E603AE72F8699D338CF6C644B2463B437FF811A395C00E98D8D96B4D418719E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0c3dbce5775ac603fb7b992f3e59e74009f8a2184c9fc01dc57c85d29521446d
MD5 9ca63b81817ada17272e60e31f8676c6
SHA1 8ed5193f4e893f8aecf7b6587338fdade20db9d1
SHA512 40fef86f52d036a24f65418972f87620f31e2697a445177b6198c34de0d805197c354b0bfe2a97a650b672df1106a70ea712f3b90e1ea030482b9d856dd1bfab
SSDEEP 768:3+39M4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3+3Xd8+p3Z6n4yIfz7w
TLSH
T1D1F2BFB1E8A9DD738CF6C348B64637436FF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 592fae040d4452ab277ee03aa62f850e844f8362ed5d2e4a81c716ff4ee3944b
MD5 933268d55966c739dc61cc05b7e9bc72
SHA1 e6999f05176df76c5bff6b63463d15abb56c8d91
SHA512 240b7807d34d4348f100897f679c91cb2f6bb94fa218a5b31e95c028e44f37d08fc4c27c5ca7587da09a9fa68fb38fb5a55ac820e19cc1ec276feae80ad4c2ca
SSDEEP 768:353MY4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3534d8+p3Z6n4yIfz7w
TLSH
T193F2BFB1E8A9DD738CF5C348B64637436FF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c7541fcbbc1426dfd426506363c7deffa80bf9f5a421e052941b73b028b80136
MD5 c059747bced383292712d91e365fa8e5
SHA1 9699c142e86f222995495a159e85a5f6473bb02f
SHA512 196d9137c9c83c3f68e553251a3f7df9afbdfb780f785348f0e8c80802d8cf05d3f517542c296b9bf409051f60c07787d146e4963bd988cadb71ac84bde0ea7e
SSDEEP 768:AS3Bo4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:AS33d8+p3Z6n4yIfz7w
TLSH
T1C2F2AEB1E8A9DD738CF5C348B64637436FF4506396C41E98D8D9AB2D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 98acb64f65fb9661d3c2e49c8b1261bb4864c4a5fac125fa9d901756e840c6f5
MD5 bd0a5af85912f38446708406f90d3dbd
SHA1 9ff831b6ea8a114ec2a90598323151664be6791a
SHA512 f4279783edf16638a679c3bfd2e8b2bf7b683a3c0ac6517db04c3bf678491a84589cfc1a2dd548e38fa13caf0091877a9792b7d8f8d2149ecafc830d7e5a3ec0
SSDEEP 768:3I3kS4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3I3ud8+p3Z6n4yIfz7w
TLSH
T1F2F2BEB1E8A9DD738CF6C348B64637436FF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 211b1bed113c89534437256256112b5236f36f5e9a0398ffed4d6f4e6cb2fe62
MD5 26eeaf1fafd07e5e42a870c0a6bbf0dc
SHA1 30a337ab125d4a58d885989d962cece2c6150dce
SHA512 7b4bb49d736a660df9833e4bec49a44506c71f4ee2cb087f0f4e7dfd02885cc163e4346a73b387caa26d78ebe1e920204b1de09d40f803ce3ffee89f617e9c64
SSDEEP 768:3Q3e+4rT7p8+p3bd66j+4BRv86aLIWmfRl7w:3Q34d8+p3Z6n4yIfz7w
TLSH
T1DCF2BFB1E8A9DD734CF5C348B64637436FF4506396C41E98D8D9AB1D045729E2B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1afb2fad59bdb1f8d7b1e6d5b8f9c92f07999e3f2d9fcc4fd2e24b1a749e0668
MD5 faa92c008ca03c05a2c5bee0f4df677c
SHA1 625d5b82e2e882b2baaf596b4c6b0d11561c90c0
SHA512 bbde599af5c045fc2b282636d1dd115430aa415457f259df62c3cc4dff410068fb61f400f3a8acdac558037837e377e13663cccf4ddd8214f1544ffae9fe76f7
SSDEEP 768:Brv+4UNbdw3OK4rT9p8+p3bd66j+4BRv86aLIWmoU:Bbsby3M78+p3Z6n4yIoU
TLSH
T17A03AE72F8699D338CF6C644B2467B837FF821A395C00E98D8D96B5D458719E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6eaa3c17ae6226dda3f7dc82395ec046ba45ff3e158e3466a1e113e3c80431e6
MD5 8da916ac53b948c3baa017ddf96075d5
SHA1 dba84cdcab864fb0bb221e7fd6b6e9bb7581b8e1
SHA512 a1406db1b35e5972525c7948c1c8c432babcac19137642783dd01e2afa2a68c83c6c61eca893574d68a49c59243ac282a02f4e9232f92e40641181c131ce501b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59b07a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b07a.TMP
Size 392B
SHA256 c9818a9e1defebb753a29d8329baf5565df7f838b330e7ad500c6dccf059d7a1
MD5 c35cd213189f77c807dec3b99aedba29
SHA1 754b4afa62d69ec3c79a3f7614fb0e67a815bbe7
SHA512 b5e12569d07ddd1cddad0883fbd583884006a07b03672847c9f916ee572694f1be3645273632d3bbb7b49811ce428ea5aa1c810889a30790802d1a7370175d11
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

69a671f5-7ee0-42b9-9a43-e64dfb292bc6.tmp

Path C:\Users\Admin\AppData\Local\Temp\69a671f5-7ee0-42b9-9a43-e64dfb292bc6.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\base_library.zip
Size 711KB
SHA256 4da90e640bb4ea0c7700666f6e47b9ebcd33dece54e974def46e6b573e9862cd
MD5 473768be8769c26b236451da39821ea8
SHA1 2ff689ddbc2dc01afa30f9f1a34482b5062adb19
SHA512 d1355047270bc43d83f7e21d73dacc72e34a61e11c599b35ce2726cc4b829cf5ed5033e6916201db821d6a1e3005f8ec489e65227e03e5c2fc9d2dd15a32c7c0
SSDEEP 12288:6gk1DQ2osQNRs54PK4I1b4axadiybfyECoQDSchcV0c/A:LP2osQNRs54PK4I1b4sadimfyECoQDSS
TLSH
T17BF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI51642\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2t5j1pd2.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e2l8f2xu\2t5j1pd2.exe
Size 5.4MB
SHA256 a42a7592b51334ec648ec4a3914dfe8a9da1f378fefec51dbcb91e5de600a92d
MD5 677c5b541104006a7bf0c303ac00f561
SHA1 32505746bd355d6dfaa7f0a1ab1a720e1c1e157a
SHA512 e9131e2ad139b1fddbc06343244c65d828329ce404f122c90e795c706864396097d122310c52148057d30eba200ece62ec233bba8dd318b19de47c5f55c7f1fc
SSDEEP 98304:jhgtsTICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHNAMZr6u7:AsTICteErownP0oTcMsABqljkM
TLSH
T134463308B3E809E1E5B3E13985665221D873B4254BB0D5CF43AC9B661F637E0AF7EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3316-1077-0x00000224544A0000-0x00000224545B4000-memory.dmp

Download

memory/4100-1052-0x000002251EDA0000-0x000002251EDB3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads