14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137

Analysis

max time kernel
4s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
Size 5.4MB
Sample260827-p5e7cahm21
SHA256 14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137
MD5 58e9c648416aafc341f60ddbef35477d
SHA1 90a9e5c50b64fbea5effefbac4cc39a574975b52
SHA512 56460983b191e2222dc0269b625f0ac27c017c19f27b59cdddb190e5d45bf9d34f19176ff68f5b3d6d060caf573a9a4b898d8edbf7832612e2c847ff7ddc0c27
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRX:OrICteErownP0oTcMsABqlaOz1
TLSH
T164463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9693
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5460
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user9539
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5298
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6670
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5707
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user4518
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2683
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3711
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user2102
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user1993
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5665
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user6490
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8303
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3733
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5067

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user8763
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3876
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user5361
Password
password123

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
user3078
Password
password123

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reo5ee.exe	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reo5ee.exe	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe

Loads dropped DLL 11 IoCs

pid	Process
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\5dbcnu4f\\do80g797.exe"	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1283	ifconfig.me
1287	ifconfig.me
2021	ifconfig.me
2241	ifconfig.me
2296	ifconfig.me
2514	ifconfig.me
362	ifconfig.me
1350	ifconfig.me
2222	ifconfig.me
2453	ifconfig.me
214	ifconfig.me
325	ifconfig.me
404	ifconfig.me
518	ifconfig.me
583	ifconfig.me
696	ifconfig.me
1108	ifconfig.me
1683	ifconfig.me
55	ifconfig.me
483	ifconfig.me
568	ifconfig.me
1887	ifconfig.me
1929	ifconfig.me
2161	ifconfig.me
2293	ifconfig.me
121	ifconfig.me
224	ifconfig.me
424	ifconfig.me
600	ifconfig.me
1453	ifconfig.me
1056	ifconfig.me
141	ifconfig.me
289	ifconfig.me
297	ifconfig.me
337	ifconfig.me
650	ifconfig.me
1179	ifconfig.me
1618	ifconfig.me
97	ifconfig.me
232	ifconfig.me
363	ifconfig.me
883	ifconfig.me
1643	ifconfig.me
1749	ifconfig.me
1975	ifconfig.me
2000	ifconfig.me
197	ifconfig.me
261	ifconfig.me
2214	ifconfig.me
114	ifconfig.me
189	ifconfig.me
425	ifconfig.me
468	ifconfig.me
595	ifconfig.me
991	ifconfig.me
1050	ifconfig.me
1206	ifconfig.me
445	ifconfig.me
728	ifconfig.me
848	ifconfig.me
1225	ifconfig.me
1465	ifconfig.me
1853	ifconfig.me
1875	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5844	cmd.exe
1632	cmd.exe
3044	cmd.exe
6664	cmd.exe
3752	cmd.exe
4528	cmd.exe
6452	cmd.exe
4204	cmd.exe
5928	cmd.exe
1080	cmd.exe
6896	cmd.exe
7896	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2036	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3216	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 3628	4788	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe	89
PID 3628 wrote to memory of 5844	3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe	90
PID 5844 wrote to memory of 1188	5844	cmd.exe	92
PID 3628 wrote to memory of 3216	3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe	93
PID 3628 wrote to memory of 2044	3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe	94
PID 3216 wrote to memory of 5780	3216	msedge.exe	95
PID 3628 wrote to memory of 2920	3628	14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe	97
PID 3216 wrote to memory of 2036	3216	msedge.exe	98
PID 3216 wrote to memory of 3544	3216	msedge.exe	99
PID 3216 wrote to memory of 3544	3216	msedge.exe	99
PID 3216 wrote to memory of 3544	3216	msedge.exe	99
PID 3216 wrote to memory of 5768	3216	msedge.exe	100
PID 3216 wrote to memory of 5768	3216	msedge.exe	100
PID 3216 wrote to memory of 704	3216	msedge.exe	102
PID 3216 wrote to memory of 2232	3216	msedge.exe	103
PID 3216 wrote to memory of 704	3216	msedge.exe	102
PID 3216 wrote to memory of 704	3216	msedge.exe	102
PID 3216 wrote to memory of 2232	3216	msedge.exe	103
PID 3216 wrote to memory of 2232	3216	msedge.exe	103
PID 3216 wrote to memory of 952	3216	msedge.exe	104
PID 3216 wrote to memory of 4624	3216	msedge.exe	105
PID 3216 wrote to memory of 2092	3216	msedge.exe	106
PID 3216 wrote to memory of 952	3216	msedge.exe	104
PID 3216 wrote to memory of 952	3216	msedge.exe	104
PID 3216 wrote to memory of 4624	3216	msedge.exe	105
PID 3216 wrote to memory of 4624	3216	msedge.exe	105
PID 3216 wrote to memory of 2092	3216	msedge.exe	106
PID 3216 wrote to memory of 2092	3216	msedge.exe	106
PID 3216 wrote to memory of 4296	3216	msedge.exe	107
PID 3216 wrote to memory of 4296	3216	msedge.exe	107
PID 3216 wrote to memory of 4296	3216	msedge.exe	107

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6384	attrib.exe
6748	attrib.exe
7316	attrib.exe
7476	attrib.exe
1188	attrib.exe
1056	attrib.exe
6372	attrib.exe
6712	attrib.exe
6852	attrib.exe
2720	attrib.exe
6556	attrib.exe
6740	attrib.exe

C:\Users\Admin\AppData\Local\Temp\14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
"C:\Users\Admin\AppData\Local\Temp\14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe
  "C:\Users\Admin\AppData\Local\Temp\14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe"
      4⤵
      Views/modifies file attributes
      PID:1188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ffd6b7dc188,0x7ffd6b7dc194,0x7ffd6b7dc1a0
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,10570853545181006396,16289534984468341612,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,3604891686586732276,8895725202063473083,262144 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,10252629791067536733,1748461258715079950,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,9577697675219384618,10311834750822029915,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,12235212018707259293,13708890566168086841,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,5379934364834736166,6364501518527189987,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,16577331691832861933,5503951080649522689,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4360,i,395753735183005594,5831798678254871353,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4768,i,3511137939088404093,14043959333542425137,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3872,i,14110000119675366107,1024752606528203532,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2180632223779869421,5549045140316968247,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5816,i,9248226793681078210,4737899830112490895,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5980,i,2587196148250399160,5918257406397945353,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5292,i,8695761723447352312,5174367013425463765,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,15549345470889701125,12226291336366502962,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,15549345470889701125,12226291336366502962,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6076315699588412170,5066161876972004062,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7680264133440444841,10845246324691346069,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5680,i,6926329201460031856,15499185908556244293,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5708,i,7342449656791893368,1436390271299234264,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5772,i,12198642399150498543,13053031446674397557,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5784,i,9644034437381697129,3567784073689267672,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5716,i,12427058578813144879,16671464954110138514,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7188,i,12320737797023096770,14018240668433731790,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5696,i,10656097314152612416,3858372770011165165,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6956,i,12054823410346149478,8223160259847724255,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7224,i,9784199933640020401,16403695257208266369,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7356,i,14491949047553227467,14623231018093766282,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:1
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7100,i,1946840157391344037,764185555070748456,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7720,i,7753166972398904380,4156560283967378734,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7736,i,17471095269005083353,10056728665670541565,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7200,i,14650547938004725067,6720987701031001536,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7244,i,3225926453275443742,8489026146965943128,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:1
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7380,i,12208057050561824083,14122123172095352038,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10172,i,13017179516541248220,17560169041684834577,524288 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:12
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10152,i,6758367851558477431,9188949069234604711,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7188,i,6926942649589039703,11074550406501621320,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5772,i,2662572473274203850,2126309143912136818,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:1
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10216,i,15153216202320127420,9626971896446246764,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=9572 /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7728,i,44687670569821147,4368193914413340640,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=9988 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10232,i,7454432854015021437,981844920886229175,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=9508 /prefetch:1
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10272,i,14980641852881114985,17409076258747350462,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:1
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7712,i,7780961961732189236,12952271200185706164,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=10444,i,12747493439498182071,17338360553407490276,2097152 --field-trial-handle=2312,i,10432079419235104059,5904993185320140744,262144 --variations-seed-version --mojo-platform-channel-handle=9732 /prefetch:1
      4⤵
      PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5264

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe
1⤵
PID:5968
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe
  2⤵
  PID:4112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4204
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe"
      4⤵
      Views/modifies file attributes
      PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2724

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe
1⤵
PID:696
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vtv5209s\sjph89sl.exe
  2⤵
  PID:4916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1632
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe"
      4⤵
      Views/modifies file attributes
      PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5904

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe
1⤵
PID:3268
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\curstp6k\lo5dvbjf.exe
  2⤵
  PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3044
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe"
      4⤵
      Views/modifies file attributes
      PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3204

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe
1⤵
PID:2308
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3eit3dmc\wkgsocva.exe
  2⤵
  PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6664
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe"
      4⤵
      Views/modifies file attributes
      PID:6740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6968

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe
1⤵
PID:1872
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdegzzda\df7s0yi6.exe
  2⤵
  PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3752
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe"
      4⤵
      Views/modifies file attributes
      PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6848

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe
1⤵
PID:1624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fcddkp69\j8irau96.exe
  2⤵
  PID:7020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5928
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe"
      4⤵
      Views/modifies file attributes
      PID:6384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6712

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe
1⤵
PID:7012
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1ije94qq\z2miaai3.exe
  2⤵
  PID:2692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4528
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe"
      4⤵
      Views/modifies file attributes
      PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2152

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe
1⤵
PID:6508
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaojzelj\vzl8ehpi.exe
  2⤵
  PID:6176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6452
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe"
      4⤵
      Views/modifies file attributes
      PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2388

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe
1⤵
PID:5700
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8bo74txq\16h5jvje.exe
  2⤵
  PID:6564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1080
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe"
      4⤵
      Views/modifies file attributes
      PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3312

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe
1⤵
PID:6544
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\320o6hgi\xvr3w1uo.exe
  2⤵
  PID:5316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe"
      4⤵
      Views/modifies file attributes
      PID:7316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7852

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe
1⤵
PID:8104
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\guj2w9j1\iec31l2w.exe
  2⤵
  PID:712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o158zmk5\lsv0v0g6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7896
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o158zmk5\lsv0v0g6.exe"
      4⤵
      Views/modifies file attributes
      PID:7476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 17KB
SHA256 bf8734ad96dffc78a68a9ce52192999b4fc058113c32d46ca332888ada18e18e
MD5 f687fc8c79bccca48fa3e877da3d33a1
SHA1 15cf76bea833d4af2d1f5fbb7a471b8310e26104
SHA512 06cb70bc0909a38608f4f5e1166ee225c5ea2c9ffee898533335c5cd8e71f2307189d19652c0337f08e1f4ee1a55caef04555e32703394c7f1b50a21b53a936d
SSDEEP 384:o1WHCOWHcFDN37Zf/TZ8SOZtR7ICXNaQwL6nbG1k+ekemgO74Meg:YOWH4rT+SKtKCiCbG1RekemgO74Meg
TLSH
T14A82E1F9BD3187DC583A92A7744044B6464443A5B42F0A965ABE28FAD2FFC183A1C39C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 33KB
SHA256 a8313e7e5fc636c44ec578aae0ad9cf73e2e5c54fb592e0a1078a8f50e49460c
MD5 276c11496515ba3dcb6fbe010ac44023
SHA1 18b6b1b5b43c3dcfe02fec3d1bce2cb1aa4ce5d7
SHA512 f8681f8bb0183b35aed5bcbe543298e4de95a5d4ad63bfa0eed8cba8bdf379f982c7cb23d9e252c8bef099f7034dd3a7195b41fd7097fc53fc581c6b0d74c2fa
SSDEEP 768:/a65FuzIwBlWwFs3TEprVJ8LzQMMlJg+GEneR+o:p5FuzTlG3TGZOMlJVU9
TLSH
T194F2F1D839A6243E60C15D3A0D582F02A7CE030DF186695E9FFEF86F9705913AF09986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 75KB
SHA256 00bcffaf19d127daea121a1dcd94fb915c6bda21a3a9973bbce31cc6f134fa9d
MD5 2c4b199630103a67aa6d0e5ffb057bde
SHA1 749223904288d58fb61e15f8ce43fed3b39e4984
SHA512 7d379aab5d4e7d2674155ebce0459980c4ec59c2e5b0282fd4c8e75daed0565529333d04a650ad3543a1fd2f0acfd140ff7cecf2c74fbec532581a9fb0055582
SSDEEP 1536:rEcN0NLbVL7lQ7BfMrUBp0ck7tQj3BCXzmB+488hc2tZh3HFGs:rEkwbVL7wBfjpk7tuRCDp488htXqs
TLSH
T1D67302DD004AD1997E8C76B52CB41123A756DA0F57EB9CB421ECAD363CC718329E8F64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 75KB
SHA256 d36ddc293dac5f9d61a5955a2aceb60e67e4032b72426f8ff2fee77cd348a79b
MD5 68d57064d114cbbbfc8fea472803434e
SHA1 8aafa5d15ed0a4f1d42f83bfd7b714794ebc5399
SHA512 e6f7b6d235177ec1626dac2424b211c94e06af3f96a145ff2fa6222288474364cb578ee914ed30d5375087e41df56cbb379d25fee2c48617d5fbb8bf84736661
SSDEEP 1536:hqfhLTkIKY49Uc+uu2FNkzHuBh1O12bv8WrP3PmTy:u/RuuFuTcSb+Ty
TLSH
T19F7302AD67D2C8F94FBF7FD4D20A1401EB949A7EFA22418C4B939D895B99206743F043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 58KB
SHA256 eee51c626c7a1d71822859cb60b9adc76648080af0b2488e8808bd39cef3f164
MD5 058ee557ee27f7352a9f1bb4388f550c
SHA1 35da91665391032cf953b12dff1c2b9592e4ff36
SHA512 a7a187f942748171e9abe0f266c47c0374bfa5554962b0300279070a5a92dc06bee7d2a4e4b254c146c4822c2b4e67657b21387e8e8b0ae56fcd682a30a8b24a
SSDEEP 1536:cZ5AXCZCh4vP+wPW0T4RXv0bS1XIFEaUqeeCuZ5F08le:cZGlkLPWY4R/DhahBHez
TLSH
T174430255B0CEC25089F34807C9E710B6ED7B49E894C523229B0907E9395D9AFE43EAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 77KB
SHA256 165fdf7d8b04b124d1870d123199f553c8b277b160ae4ff933fe9f8c9866b976
MD5 1dd32ce2bacd06e9e7dc3a27d6920753
SHA1 34952495908a0fa300f6abc9911a230cdf919eec
SHA512 f502cefebe80d52f40d1a799109c93f89e8f23879e937a5ebfb25aceddc2b049d968dfea55e76a59ab7cce233b8b9d8e4b6cf18ff36f98599f72592d06cafc4a
SSDEEP 1536:zkcTd81ovZpzBjp1gnd4eqFBYhoG3gDBcpQralpzShOB2rQf70O:wc581Cztp10tiCpoalpzShSj0O
TLSH
T1ED7312462A5CA5245CFCDFDD138379CE6804C7C107E1AB6C712B205771E1F2694E9E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 108KB
SHA256 4853ab137e32fcda3d5e7ba9446aa131c05e1f27b2a066f1d8d0610f63f47c22
MD5 68b99ae073376513f2c8b49d6fd7bebb
SHA1 1ae025c5d88c6319c9228e44343649e2a27a9a6b
SHA512 52e9a99bcc643514a84559a40fab658346dd92fb410fb9f46d42d5f1295f31c27beef01a5dcfa414ebc63cc299a8643b6ab33ffa364567f8c3e7ac57cfb2adb2
SSDEEP 1536:EotBJWbHihMYJT6l6c0rqReFoo+qJL0otK+5gstgdsLXI94VtVZuwxKdQpbhQtG:FPJW2hMYpNrqRraL0otziVUfoaOQpi8
TLSH
T109B31241FE252B409F499EBDA8E35F734DDB390224870279758B7DE3623A168C3ED894
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 219KB
SHA256 257941e9f6ea7081314fbc03a16740d1401f5b020552a46b2e7b52146cacd1e8
MD5 5c4dd87cd84da0b2b274b482a2e0b94d
SHA1 0d9fe8886c864830dbdbad6af8d2cf05a36933d5
SHA512 c3d36aabf9c9dab886145c519c8171a83cc52a471ab175ffc28b6ed7cb2387ed32b07824ac94589e45d4036a6120655d4c90095a0e6e8b549921c02ba98c27d0
SSDEEP 6144:lz49qsDW1Cuogxuh5kiY8DG9y+oUUY+mz5d0w:lc9qD1Cfouhi99roNY+mzr0w
TLSH
T10E2422AA8F174848F95907B131305C960AB6DA6ADD52BE059CAFC12B9B5C377C03F3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 281KB
SHA256 83ff7c0955f9de468f2076eb67da477e4644793587d5db55507bf5251abb8f9f
MD5 eaba89625db50047d365d02bf2b24a92
SHA1 b2ffc4a9a74bb627394b985afcfcb892d91897d1
SHA512 04ce099624be7e3984dfebcc1641b4c3ef292e230394c8e9a57388e401942ca5d0045195bc9f4e2142fc56f42a2d5cde10327faa20332a3c01c8638b9ce0e4fd
SSDEEP 6144:0fM8uqM7iHI7lv4G7R6L+kxSQ3GScYxpZYngVHiufDQ7VaaYS:0k5SHk56+kP3GSQgIAw
TLSH
T1EA54231ED7EB69172A5C90BCD0B34BB882772092BBD1438687237BE75EB1C4254D5788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6adf9d9a0e2dc826_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6adf9d9a0e2dc826_0
Size 4KB
SHA256 3f6a8b37e785cfa9e4ca683a59550e16c741b96609a2f889944de863ef1baece
MD5 90cff11b75b8eb20f9709dba930883e1
SHA1 c86121804fb33f2319a6cde19fff514507ea093c
SHA512 40e1779e20c9adc58369147c24cc5f7d0915011c926a1dec135fe63f81dc48260f98521956694ee3dfefbb63e573222deb6fb2dcf59ae76e70be5199d182b8ba
SSDEEP 96:bbJ6Trq9yDTolA4TusUDueAmf04skkUCsf+BcDrh0GCC4Q:bV6TrAlAge3f/hfLDjmQ
TLSH
T1D5814AB3F8586F08CD4F62F89CA14474497EECB92B128C00D0111B1573A22AF1B9CF27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8689ee10d38295fa6a4def99a2a7d8de009b39190b2f7b8a13d2369a7c36c98b
MD5 3ee18fe198e177016ae7c24af7c7860d
SHA1 9ffb35cfbf607a881357427d0e83a71f4ec215d4
SHA512 ce6bf921a519ba475051fa01d3c23cb8a562848972edd04e235d049acfddf6088a1d737b4f061766e8c0bb684ca3baf145aefda04ba9314c92c4beb9c884c7b2
TLSH
T132619643A76167ADCB71457A90E8B9D636F2B06B90772F2198106DBD0962F38C0CE9D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c569.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c569.TMP
Size 2KB
SHA256 8b0e1a955b5400af90101eb271b8e9b442106fe5b098d3b77ca67188eb123b7c
MD5 0f32f7b31ec5fcf415bf17c594fb2ed0
SHA1 230768e8c5faa7fa038516728900b9780d9d0c98
SHA512 5729f9700692950b83eb75a70a339fe823671f85ec87d22faef340b4aed1c8f9f1112ce8c2e33eb8563347aa9787f8744553e6890d6f9a20186ea66569b49bd3
TLSH
T15E512F07333267ADDBA155B250E8B8D636F2B56B407B5F2088102EBE0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f0da9cd3efde283cc229a9b09a41d18e144dae59768a513ee23d6cb926352f4
MD5 838041291fd7ff35f044af1c21a95e17
SHA1 40a5d001e8ade9d97f61435ee41b27d9cc3086fa
SHA512 b27b8b92b06beba0286f5ebd7e7b69f17364693af47bdc895ed0ee937994926d4593daba7cdaa873988d0ca9e8105f79e7ad0a5707a62ea53b8904a1691ea712
TLSH
T13A31BEF3C6E85A3D894146F87B153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0d5dd1ef40ac46bf71a5e51381c41aa48f81374d41b8b02947a1d24862cd9a99
MD5 fe4bc364564d3d66744b34c937f78a0e
SHA1 e6e43daa618cd9c11b0aa84c6575bf3ef7017ff3
SHA512 9a531b01fda44211692f978950b41cb965474766d6260941c8c1cfc9b6a702c12a7144b451bf866acce7b3de664e9611e2d29fb86d269bf0749304d0c7223a65
SSDEEP 384:sxR0Aqodw/fhcscOc5lxV5HWL5hGZBNdo:sqoq/faOElJq5IB8
TLSH
T12B42D9165928A97B4CC7D22DFA15BF63D3F92032A1D11E44E7FC9A1C14EA6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5f685cc00c322345eae18e29f05ebecb767f216207899c73ddc6aa0045a6a4a
MD5 98553920c23e5a1c7e321eb0aa71b8c9
SHA1 f4f2d2b576458b5644eb546fe120f958b7f94081
SHA512 0618722359f74060d45b8de2ef65e160a8a1dc973dead914d31375811ae5b3b1e0fb7af2e0af84bd91076da370f011724946a512930fc12733157becbf534e01
SSDEEP 384:sxR0Hqodw/fhcsbOc5lxv5GWL5htKpDNdb:sHoq/fFOElGq5mDn
TLSH
T1D152F9165D28697B4CD7D229FA16BF53D2F92022A1D05E48E7FC9A2C00EA7DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 da8ee24ec68275d523b8cf0ec639a7a4d352e3dfc59ffa2bf4cec95f5fe39868
MD5 ec8890c53efa3fe8834c72c6162e0e69
SHA1 df9208e682f96d27757a80bb3fbd259c87d189ff
SHA512 47abfd888ab4679bdd53672344f17819d863612eb7ac2a46d93e79d10176ae355a0b6d03ad78022d58afc48447697713ac4527735a3b1dfcb270073c12136fc0
SSDEEP 384:sxR0Hqodw/fhcsb2c5lxp5PWL5htKpmNdb:sHoq/fF2ElFq5mmn
TLSH
T1A052F9565D28697B4CD7D229FA15BF53D2F92022A1D01E48E7FC9A2C00EA7DD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 693ffcac2dd8c506d5a0fa24decfbfb5009540c708d006d181e1aeac598349c4
MD5 1c7546f5004caef839c90c6c0ae7e3e5
SHA1 0fa50fa19d251a816d99a4125aa53af6a6a4f992
SHA512 573e20c53c040534d1a3b333bd8d2f9d23c1c9e089cd7307d38e4d5e7f661c6c6cfb1e4ec273a32edea434b059a7e79e51ad97cf9bda0c6c523dcef7c4ac3dd7
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7Qqc+roZ1:jC+vA7E7JQWgQ+f4+u1jacVcVf
TLSH
T14AC2FA7B640DCF7F4F804ADDAC197E9B6DA802CB5698CD5047FE841C02C6BEE92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6fdc42131143e27c32633ca2ae8f7fc5c786c94bef0ca960b948ca772ba15530
MD5 71fa34d8805762a696248ed723cad8fd
SHA1 37b0c779817bbf047dad7e0c09ee17a27aec1bf9
SHA512 c32e4a35923853a60f2d1c318133b2ffca9d46d4c78f7252d000fc2ef4aad087e1fd9845fc939d58d6c7796773ae77977d37bee99c8cbbf941de38d3915fc93d
SSDEEP 768:Irv+4UNbdD3fc5VNp8+p3bd66j+4BRv86aLIiJ2bwCl1:Ibsbp3SL8+p3Z6n4yD0ww
TLSH
T19A03BE33E9A899739CF6C648B24676437FF851A396C10EC0E4DD2B4E419A19E630BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 675642c5521179b0229fe55a83335af6de86862a77168bf438cba8922f27cb04
MD5 ded220a6702dcfdb0504a9188342e746
SHA1 6513f5aef664978ea0eb4b8376cdffb277c3d024
SHA512 a3107825423823f58d07f5983de6aa775fb79c609113141040bc08ea4dc15ac2947211f6b201671aaf618c99afd9e7f8271ea4c07b5cd45518778de3f11a80c6
SSDEEP 768:BY3jd5uvTp8+p3bd66j+4BRv86aLIW+9BX:BY3sl8+p3Z6n4yo7
TLSH
T1C5F2AEB1E8A5AD338CFAD249B64777836EB850B395C04E94D4DCAB1E148716E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f03c38a4606c7f88dd87cac036260e42efb3223cf6a3aa30cee6da900ec5834a
MD5 ebd97d0ed64b223634c177479c2e8026
SHA1 c1d511c91c2d5a98f0b8be01035fdf4d77b440f4
SHA512 88a5b3a9d0fdf682318a18b5eabdc83a7336e6cc7b2f925101b3764d384368a60277c6d7d6e729a0bdb104fec4667e5e061d7e99046c6f5f20f331a664f11aaa
SSDEEP 768:Xrv+4UNbdD3G35uvNp8+p3bd66j+4BRv86aLIW+2bwClW:Xbsbp31L8+p3Z6n4yo0wT
TLSH
T17B03BF72E869AD739CFAC644B2467B837FB811A395C10ED4E4D96B4E014A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 200c7e15ed6983301e774b00e6cb96d4536a85d83e4b73b0c521562d49c6b35f
MD5 b8f3b37d25691914e9f1d0583bc49879
SHA1 b0bff27f24e83b6e6b22b927a050940d3891fd55
SHA512 c4bfebc028b0e48a1ed923a10773d61738e9d20c078b63a98114bf7feb232cab315ecbfc7b12b3ead2537fb7cba5e048d55da223c38957980ae8d46593bb9516
SSDEEP 768:BF3lF5uv6p8+p3bd66j+4BRv86aLIW+9BX:BF3+k8+p3Z6n4yo7
TLSH
T188F2AEB1E8A59D338CFAD249B64777836EB850B395C04E94D4DCAB1E148716E270F83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 99bd427aa07c0128c5a30bd02c1164fa65faa0a3f649da7339553c7fa14e016f
MD5 d70c40fa392bcaa4ef750c872c2b8d60
SHA1 f0da8d665e22ab529ccf04f02f5ae7db59afcccf
SHA512 9fd4ba3f1ab33ae501a38b9772fe7723fdfe4f23461c164b69ed9d328a22fa93c7a52d0c590b88a98af5031751a420bf40f289fceddb0a9fdf7ac3164652edb2
SSDEEP 768:BI3tj5uvTp8+p3bd66j+4BRv86aLIW+9BX:BI3Yl8+p3Z6n4yo7
TLSH
T15AF2AFB1E8A5AD338CFAD249B64777836EB850B355C04E94D4DCAB1E144616E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5117dbe7c8d2d7673a1dde4cf6f2650ddf54967da8417786dcf361bf813c9619
MD5 f4634fc42d7aa0ada76a8d771e2af50c
SHA1 46b159e5003bdc5669c4ffc7eab3cf3f4fd373d2
SHA512 fd8284b8a12607b71c680a8a3b9fed3b1e9ac8ee90f0149b83f1ac06a905efdba1602485c35ab8422b136de4810cb9781939761e48abafa2b5462e6ae350d004
SSDEEP 768:BI3tP5uvTp8+p3bd66j+4BRv86aLIW+9BX:BI30l8+p3Z6n4yo7
TLSH
T1A5F2BFB1E8A5AD338CFAD249B64777836EB850B355C04E94D4DCAB1E044716E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 cefbbe62a2fa8b366e71dcbb2a21e28d648d1024c34556831d07b3a43d813c75
MD5 96e66d30f82320f9c2ac669f3e8634ea
SHA1 002bac5f59c6c96fe57dacdedd22992e3ee8a9b6
SHA512 36acffcc853615df6fe86269c9c9bad000d90c74bb2171bd880475bce92b36fbb2bd025d0532627e4bf7a637150cdf185d1b9d3564d5a32fca438dbf4faf3d77
SSDEEP 768:B13Ft5uvTp8+p3bd66j+4BRv86aLIW+9BX:B13el8+p3Z6n4yo7
TLSH
T173F2AEB1E8A5AD738CFAD249B64777836EB850B395C04E94D4DCAB1E048716E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 2d3c3cc929587d7f3966e157e53e46340c4b1b40aac16a3ea150938c808d20db
MD5 7376fec4351516f48277a900c91c99b2
SHA1 fa3e727c9594c0500364c3b7362e4e0115dfe04c
SHA512 59bf81d3ad606b467b2f12ee6c6cb72bdcbb35298361f8de285504d486f293c1645da39330ff39708339ab7cf49ae882cdd5f3cc4193acc0617c5ec71a58f133
SSDEEP 768:Bt3wr5uvTp8+p3bd66j+4BRv86aLIW+9BX:Bt3Ll8+p3Z6n4yo7
TLSH
T1BAF2AEB1E8A5AD338CFAD249B64677836EB850B395C04E94D4DCAB1E048616E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6ba4d315202acfd9ff2d466c1509f82a2ceb15c496e671ee4c839db5655ebc5f
MD5 270163d7b68141116c25868c326befe9
SHA1 35a9875f9a7bcada75ede86690ed38c3dc55beed
SHA512 6c53d480b7510a8724f68b3311d341e370e969d1eaec6c898380ac6378f8fd136b874f21f4ffddf5b2ba066d599fa534e424585efaf7ab7c5692c007eee63f6d
SSDEEP 768:En3C75uvTp8+p3bd66j+4BRv86aLIW+9BX:En3Nl8+p3Z6n4yo7
TLSH
T105F2AEB1E8A5AD338CFAD259B64777836EB850B395C04E94D4DCBB1E048616E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ec741ce3797796b23fc160a0625b421f30cbddfd9d3a7504a6ee555f2d9d1c5b
MD5 962caf7c942cef173f7b25fd488db1ac
SHA1 47c519aab990ce15f557fd729d8e7bbf2f2f5cb1
SHA512 400cd65dcab81b0841867fcfd9e74fbfc0d1891b418a012c77404a6b4f57d66ca34c5064a814fa94e0cf39089923f9135a6167a486b0f835ce1706814e0da517
SSDEEP 768:/rv+4UNbdi3u35uv9p8+p3bd66j+4BRv86aLIW+DG:/bsbo3V78+p3Z6n4yoDG
TLSH
T18003AE71E8A9DD339CF6D648F1467B837FB810A395C00EA4E4D86B5E019A19E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2e140c37c03b74333a7a010a42241f0f5f47ed08fc6310686dd20c921264190d
MD5 f96176eb0547fcfe80aee4d39222c78d
SHA1 313e918bd6668525dd93e836af51de3cf3f704b9
SHA512 e098bcea1d37701fe463aa2c67eabd3660ed5bce7fa1fb8d430730974eb6457740371d8605fa351eef7247ac392f1e43df04800ea743d2d1b2990af04e420db7
SSDEEP 768:rrv+4UNbd73Kb5uv9p8+p3bd66j+4BRv86aLIW+DG:rbsbx3l78+p3Z6n4yoDG
TLSH
T1A5039E71E8A9DD739CF6C644F1477B837FB820A395C00EA4E4D96B5D019A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b8ad700b775f76c1694f98bac95a1fba5e0abec32ab4dec4f6ef213dfca6c715
MD5 b1c10aa7ca5a3b7fbdbdbcff828d8687
SHA1 f5b8302f7b08de1aec78c568ccfc81c2fd284f82
SHA512 195172a647c0785abb382a34365a4802a973558f1566602266ebe75844efc881ecc505ee0808e7b2bac497da285ffa2dff05ade9a038c7d200915efae58a59e3
SSDEEP 768:5rv+4UNbdD3jh5uvNp8+p3bd66j+4BRv86aLIT+2bwCl1:5bsbp3oL8+p3Z6n4y30ww
TLSH
T19103BE72E46DA9739CFAC644B1867B837FB811A399C10ED4E4D96B4E005A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94706e20-03b7-4989-ba27-db5b35902a27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\94706e20-03b7-4989-ba27-db5b35902a27.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59290a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59290a.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\base_library.zip
Size 711KB
SHA256 e528f07acda43e119cfaa3dbb3f7aa662177bfb9cdaa10414e4cc95e1f26f30f
MD5 64de17b87b994f806fda62c19803a01f
SHA1 dac588f8cd604c5890f064abd20c7745fd2481ae
SHA512 803eae64c8526f3fb4ac06ba96b9819642b6bed52de67ed5ff406836018f5a55e84afad89a4227fdf758f8b5c56075dd7aac4233d9a065c67414409eee5c2f73
SSDEEP 12288:6hynoQDSKAAk1nfyEVV0codiE2osQNRs54PK4I170axEC:HoQDS5AqfyEVV0codiE2osQNRs54PK4m
TLSH
T1BFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI47882\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e31f5d5f-82c9-41d0-9028-581638d27b4e.tmp

Path C:\Users\Admin\AppData\Local\Temp\e31f5d5f-82c9-41d0-9028-581638d27b4e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

do80g797.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5dbcnu4f\do80g797.exe
Size 5.4MB
SHA256 14bf3eaf1a3401db8f34c87346d1a6f16f3b5290b79e7128ed7d02bab0699137
MD5 58e9c648416aafc341f60ddbef35477d
SHA1 90a9e5c50b64fbea5effefbac4cc39a574975b52
SHA512 56460983b191e2222dc0269b625f0ac27c017c19f27b59cdddb190e5d45bf9d34f19176ff68f5b3d6d060caf573a9a4b898d8edbf7832612e2c847ff7ddc0c27
SSDEEP 98304:aogtrICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllkHsMsM6zRX:OrICteErownP0oTcMsABqlaOz1
TLSH
T164463308B3E808E2FAB3D53D81565221D472B4254BB0D5CF43AC9B762F676E0AF7A750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads