Analysis
- max time kernel
8s - max time network
62s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/08/2026, 18:02
General
- Target 61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe
- Size 5.4MB
- Sample260826-wmvmmstdpf
- SHA256 61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3751
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8774
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5948
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2446
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8436
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2581
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5552
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1488
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6492
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1943
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5378
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8970
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6481
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2590
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8490
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1851
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8513
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3793
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5498
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8699
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5101
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1202
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8933
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1413
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7658
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8907
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3675
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4917
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1998
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4554
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9063
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5957
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1924
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5885
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3595
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3845
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2135
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4133
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2779
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2428
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8632
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5564
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5117
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6102
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4951
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7451
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8341
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4842
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9490
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3846
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3240
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7191
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8993
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2783
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6632
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5176
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3734
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4656
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2611
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8388
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3123
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9656
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1545
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7180
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9533
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user6262
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user8447
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4493
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7250
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1458
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4431
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3146
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7888
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9994
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1107
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3245
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user7150
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user5864
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2386
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1318
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user4584
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9990
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3888
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user3705
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user9998
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user2885
-
Password
password123
Extracted
Credentials
-
Protocol
ftp
-
Host
138.201.132.148
-
Port
21
-
Username
user1501
-
Password
password123
Signatures
- Creates a file in the Startup directory 1 TTPs 4 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 34 IoCs
- Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 64 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Hidden Files and Directories 1 TTPs 21 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe"C:\Users\Admin\AppData\Local\Temp\61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe"C:\Users\Admin\AppData\Local\Temp\61835d382ef64f3c890dc37a385a63fbf8b7c0af51b67cf32a50c2bdb22c088a.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffb6447c188,0x7ffb6447c194,0x7ffb6447c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,10644656994998230362,15859657319240914700,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13693122846457249124,87592661770046002,262144 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,1700615533599195284,14090308804947713997,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,15878027289248852504,6358478182957804928,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,2511045222509804156,15094608879454797542,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,17937491237950611971,731176062316112054,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,3251153659508913842,10573124502550692000,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4576,i,6158008776099679426,3012220220847550419,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4952,i,16850379956256320619,6943287640484775336,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5576,i,7466067539259662870,17194846991419047886,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10853766370399269926,10843122607093951882,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5768,i,12198863595783327926,4808294277005823747,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5932,i,11982721321708965502,3822771371477814813,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16410796752814738354,13053302213724109365,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6292,i,43939189376796500,17088038611125133212,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6268,i,16691061767583908655,14176680469347176763,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3524,i,3989187987879198738,10903079367859950534,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,12320657323662453300,16563077113773794008,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,2850240628503993332,11623672288059535338,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7144,i,7532565869723580342,6742216090017563828,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7372,i,5846369272396047469,15309645094359461964,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7544,i,7108699582029137947,6036239145972273888,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7524,i,15701261390614453803,5930567167050573732,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7488,i,10671816513055019230,14294095489952654162,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7892,i,826586384221177923,8008076745141404142,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8188,i,5555915217518611641,3350067975582190973,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8360,i,5168995100185313278,14547773037174842411,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7684,i,13936910816790175180,15836740536208488776,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8236,i,10159978959265990465,13029242165854161572,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8820,i,9287643116081832561,700250840066270584,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8948,i,3700416442115726342,17662048583454579396,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=8944 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9144,i,16977447653625196888,7740350544537529762,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=9112 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=9252,i,13128370514195960078,4269233281127119659,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=9280 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9244,i,6742725926637566406,15208757257004151497,2097152 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10796,i,15842151539997713286,14020924745524510053,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=10736 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10796,i,15842151539997713286,14020924745524510053,524288 --field-trial-handle=2360,i,5376003331562365120,13825858079075763790,262144 --variations-seed-version --mojo-platform-channel-handle=10736 /prefetch:84⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hmnlfm5j\hwl9biya.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3hekhhe\6od9gcgh.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\k18alb2i\p1w3p9pc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bpvr7n9\0a1h1dil.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3viaj7wo\03i4zud2.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1odzxqts\vd1yobks.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\z8d785nq\8x3zwjkf.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\m9fotgdg\lw8rqugc.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mq73utog\qsgozz7x.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l48gl5du\9kt5hwza.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6y3s5aeh\6ifwh85j.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mimwm12z\8wvnvs14.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2yv5zbeu\k4muonn6.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1qykaipw\8138w0xq.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j001r5cp\5wm3y1za.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\w4h758me\358de7wa.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\crpbb1c3\2fz5vhts.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\f4qhoomm\8ffg3r0w.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9noi995n\q94tyiek.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exe"4⤵
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\uq9cb6u4\u75bf0vs.exe2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zmrhrfxb\cymmn7f8.exe"3⤵
- Hide Artifacts: Hidden Files and Directories
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
030a8bd2-b709-4510-b66e-108111d643ab.tmp
settings.dat
settings.dat
f_000080
f_000082
f_000083
f_000084
f_000089
f_000090
f_000091
f_000094
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
aecc1ac4-321f-45b4-8265-34602dcbae94.tmp
bfefd3df-f54a-4346-97df-9a325d631ee0.tmp
metadata.json
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
libcrypto-1_1.dll
libssl-1_1.dll
python39.dll
select.pyd
unicodedata.pyd
b864732a-38f2-4d4a-a5f5-bd4247d981c5.tmp
d6f763e5-ef42-4725-a836-302911d4a4ea.tmp
c4ea392a-ebe5-48ae-916c-3876beacd362.tmp
hwl9biya.exe
memory/5280-712-0x0000023BCB3F0000-0x0000023BCB73D000-memory.dmp