6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6

Analysis

max time kernel
57s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
Size 5.4MB
Sample260827-tabynaab95
SHA256 6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6
MD5 92a36d0ac99c8fc1298e45f10ab52133
SHA1 fc3cc82356e55bf11ea960dc6460aca7b4725a86
SHA512 f40200000233078af2fb20ddca1e2d0092570580a7948b84eedce43fab13187bd92a0c6750bc08202d6c16398bdb8437f3fe71b16fdcb284c07d85eb556074f1
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrZ:k7ICteErownP0oTcMsABqlkgczF
TLSH
T155463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p09qwf.exe	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\p09qwf.exe	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe

Loads dropped DLL 11 IoCs

pid	Process
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\25zi930c\\5vd2tj97.exe"	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1269	ifconfig.me
1522	ifconfig.me
2022	ifconfig.me
71	ifconfig.me
370	ifconfig.me
658	ifconfig.me
680	ifconfig.me
1396	ifconfig.me
1745	ifconfig.me
1922	ifconfig.me
241	ifconfig.me
318	ifconfig.me
1041	ifconfig.me
1187	ifconfig.me
408	ifconfig.me
500	ifconfig.me
2111	ifconfig.me
96	ifconfig.me
240	ifconfig.me
313	ifconfig.me
392	ifconfig.me
912	ifconfig.me
1128	ifconfig.me
1375	ifconfig.me
1971	ifconfig.me
41	ifconfig.me
272	ifconfig.me
325	ifconfig.me
411	ifconfig.me
840	ifconfig.me
1145	ifconfig.me
1781	ifconfig.me
1895	ifconfig.me
189	ifconfig.me
234	ifconfig.me
1627	ifconfig.me
1891	ifconfig.me
1342	ifconfig.me
1696	ifconfig.me
213	ifconfig.me
367	ifconfig.me
718	ifconfig.me
1073	ifconfig.me
1111	ifconfig.me
1398	ifconfig.me
1437	ifconfig.me
1872	ifconfig.me
74	ifconfig.me
327	ifconfig.me
443	ifconfig.me
533	ifconfig.me
1425	ifconfig.me
40	ifconfig.me
344	ifconfig.me
636	ifconfig.me
790	ifconfig.me
871	ifconfig.me
1158	ifconfig.me
1219	ifconfig.me
1784	ifconfig.me
193	ifconfig.me
361	ifconfig.me
1060	ifconfig.me
1746	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7684	cmd.exe
6096	cmd.exe
5376	cmd.exe
7040	cmd.exe
6508	cmd.exe
8156	cmd.exe
1660	cmd.exe
6740	cmd.exe
7020	cmd.exe
7532	cmd.exe
7744	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1428	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 5556	2868	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe	89
PID 5556 wrote to memory of 6096	5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe	90
PID 6096 wrote to memory of 1364	6096	cmd.exe	127
PID 5556 wrote to memory of 2820	5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe	93
PID 5556 wrote to memory of 5048	5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe	94
PID 2820 wrote to memory of 4320	2820	msedge.exe	95
PID 5556 wrote to memory of 5968	5556	6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe	96
PID 2820 wrote to memory of 1428	2820	msedge.exe	98
PID 2820 wrote to memory of 2264	2820	msedge.exe	99
PID 2820 wrote to memory of 2264	2820	msedge.exe	99
PID 2820 wrote to memory of 2264	2820	msedge.exe	99

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1584	attrib.exe
7124	attrib.exe
6856	attrib.exe
1364	attrib.exe
4228	attrib.exe
6880	attrib.exe
6724	attrib.exe
7584	attrib.exe
7200	attrib.exe
7904	attrib.exe
7892	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
"C:\Users\Admin\AppData\Local\Temp\6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe
  "C:\Users\Admin\AppData\Local\Temp\6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe"
      4⤵
      Views/modifies file attributes
      PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff8c7c8c188,0x7ff8c7c8c194,0x7ff8c7c8c1a0
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,10130087394877937524,277888191496414376,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
      4⤵
      System Time Discovery
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,8245285177255180622,8912735582683165699,262144 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,15598405696274172060,2459822990869324513,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9548175263229195139,10001689821649353738,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,6729154794039318303,3137253367719859157,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,10656050151126871735,12879928152096089229,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3466991679145115569,2312614509283647753,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4388,i,5305591787008148494,15875675124572288656,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4804,i,4149717878057195831,18097047824257597091,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5556,i,5645563684530816158,14528988066757216644,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3860,i,10801181517616235457,8754222705149451331,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,7327102340225176360,15563106674819507357,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6124,i,6663944402302784699,17625583979695769108,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6304,i,11745503220505721126,3063940421861585851,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10271731079415776146,6830546968442894631,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,2039678797599783678,15189647920705095731,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5960,i,14224121206159692221,2439574340411775425,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6100,i,1084830684437670579,6433923768058370318,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5972,i,17319739044477389949,4827223588830997467,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:1
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7276,i,2270916216995073557,13280256883359264781,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7608,i,833638187864656973,7030197907051476693,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7856,i,78192636124056093,10745837356859610971,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8028,i,13725622699548082500,11389218032885575282,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8264,i,5439205317295330341,6735207712775156852,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:12
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8400,i,13890548480019242735,15401667189460467791,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=8428 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8416,i,13484827589918679690,699712147132468714,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8548,i,15786050709733806918,13298520996564025755,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=9032,i,9331671368892679538,9605510637377146522,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=9048,i,4308651244916869833,6284179228206292147,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=9312,i,6825631333211376116,830409847063409802,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=9332 /prefetch:1
      4⤵
      PID:6428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=9732,i,5589550374574309386,248079195960111867,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=9768 /prefetch:1
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=9912,i,16699025217101142914,9387734948070526423,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:1
      4⤵
      PID:6584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=9916,i,12499879215460645555,2109795512612747148,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=9908 /prefetch:1
      4⤵
      PID:6668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=10028,i,1742651453877722445,15894256907513928714,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=10008 /prefetch:1
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=10088,i,7285528090978211517,11632825169218287350,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=10144 /prefetch:1
      4⤵
      PID:6756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=10132,i,1936222370052937645,17669911551551056698,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=10252 /prefetch:1
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=10548,i,13661459959740223016,13731514998983756680,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=10564 /prefetch:1
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=10728,i,11359885215245666113,5785903676766940949,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=10740 /prefetch:1
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1515250554560653013,13569583635180307082,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1515250554560653013,13569583635180307082,524288 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=12348,i,11334324459669698523,10665540564042810893,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=13152 /prefetch:1
      4⤵
      PID:9376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=19944,i,2641815350610537982,10555000527895311603,2097152 --field-trial-handle=2348,i,5618328757751289669,11638455339274791583,262144 --variations-seed-version --mojo-platform-channel-handle=19904 /prefetch:1
      4⤵
      PID:10336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1120

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe
1⤵
PID:4964
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe
  2⤵
  PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1660
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe"
      4⤵
      Views/modifies file attributes
      PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1364

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe
1⤵
PID:4332
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2j5jpmp0\yy0ie4lz.exe
  2⤵
  PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5376
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe"
      4⤵
      Views/modifies file attributes
      PID:1584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6404

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe
1⤵
PID:6536
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b3e0b8v6\097yvaql.exe
  2⤵
  PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7040
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe"
      4⤵
      Views/modifies file attributes
      PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6444

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe
1⤵
PID:6552
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\mhfi7p0z\149ywp1j.exe
  2⤵
  PID:6680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6740
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe"
      4⤵
      Views/modifies file attributes
      PID:6880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6888

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe
1⤵
PID:6828
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3p7qgcw\38tdhqa2.exe
  2⤵
  PID:7084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6508
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe"
      4⤵
      Views/modifies file attributes
      PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1712

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe
1⤵
PID:7128
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zrv42gm4\z0ysr3te.exe
  2⤵
  PID:7080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7020
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe"
      4⤵
      Views/modifies file attributes
      PID:6724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7360

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe
1⤵
PID:7412
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ga353lta\ybccfdv1.exe
  2⤵
  PID:7484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7532
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe"
      4⤵
      Views/modifies file attributes
      PID:7584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7820

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe
1⤵
PID:7996
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9ndcyexz\yy58whbx.exe
  2⤵
  PID:8068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8156
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe"
      4⤵
      Views/modifies file attributes
      PID:7200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7464

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe
1⤵
PID:7644
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\450ue1xo\dic5tg2l.exe
  2⤵
  PID:7772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7744
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe"
      4⤵
      Views/modifies file attributes
      PID:7904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7300

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe
1⤵
PID:7716
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wsld20gs\18jz35z5.exe
  2⤵
  PID:7904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe"
      4⤵
      Views/modifies file attributes
      PID:7892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1708

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe
1⤵
PID:8348
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygv6r4dz\we26mdou.exe
  2⤵
  PID:8444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9108

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vk9nqn0u\bh5337yq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vk9nqn0u\bh5337yq.exe
1⤵
PID:9168
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vk9nqn0u\bh5337yq.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vk9nqn0u\bh5337yq.exe
  2⤵
  PID:8904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

9f7dcc52-e6b8-4703-a533-cfb5022961cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f7dcc52-e6b8-4703-a533-cfb5022961cc.tmp
Size 27KB
SHA256 39e28c6ffabf4ddc48c299403043a8c2199908416e83e6fccdd72fc3ff53dede
MD5 8b2f593ac2442e296024f9a79c7a0a43
SHA1 fc0901793060b551121d8d5f5a96750672a63749
SHA512 584eda7ae1e822f99705d673811898add26f9b8409e5cd6ebe74396fc52d5a2329103374527e380fc273c7745f3baab4d06181ca8b7721351f3034c655d6aa11
SSDEEP 768:jC+vAN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpQqcNroZw:jC+vA7E7JQWgQ+f4+u1jaGVcmS
TLSH
T1DCC2FA7B640DCF7F4F800ADDEC197E9B6DA802CB9698CD4047FE941C02C6BEA52194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 298KB
SHA256 07ba87c0464ce9a9bb3745c093316ba13f9e44ad4474ddebf71156f5f0089ecd
MD5 056bd0f506b5e6e35e0b6f131bd1baf3
SHA1 4fb8bbef666c5f94c995be12774be78bac559bb7
SHA512 ae1c06fbb100c34d08dd479723430704a4eb3cc947b7b5584ee284cad412faac910acdb418ad94b49e527a865e8e55996aa8fa8f952b490996448e56df0cc1c6
SSDEEP 6144:4fM8uqM7iHI7lv4G7R6L+kxSQ3GScYxpZYngVHiufDQ7VpNFrsFwRD:4k5SHk56+kP3GSQgIAyfIS
TLSH
T1CB54232CD7E97E673E1C55BCC0F3079892B62492A7C093951763AB6B5EF1C0294D63C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 29KB
SHA256 397688e842c93065d8885e278d65f8dbecea80fa9a3b7d7234dc1c13cfd15c5b
MD5 900e1a4e27371a6b70ce3a706a411717
SHA1 13bcdd780e9580e2cd74cdceee8b27f6d0184007
SHA512 edcca2f2975089b06c2345d38611caf00d43e8ecd6eace44b2d1f68c40e15514dcfa482adf4745b0fca77718e5055ee38307bedeb77337b893ead762a14fec94
SSDEEP 384:hu2NXjOrsEQgVsc1gp06MWK7Gh4nbIjLlhF89MOnefMc9V0DAbDe9fNniTRUYjv1:FNX61gbMWK44bIjRGJe0c4DNniFf
TLSH
T143D2E1644624F3774D2B5A3C1EA1527AF942A3F843721B24EB5A74733C287CE422C8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 43KB
SHA256 6e99b810ad4dcbaf34328873b99a6cbe465c7cb3fb324711d026e066edfe0496
MD5 1445302f1b96e71a00517027b95d3788
SHA1 87be7bb86e7474dbacbdec3cb680f43e16fa75c1
SHA512 c1d995df45f3601f7eff11c7436e5218bcdeb08e2a2da0f2776db6e0affb54e2c9a8e2424d42baea748c84d60ebb55fa7b4f99138d0d511f560934b4d306f277
SSDEEP 768:IBKXDmVlq2aQmGAvzE6OI15Um0DvfwA8qwJklj4UT9tQ/SZYKh9:IB6DmVlpaQm9vzE6fKvjCqYKj4G9tQOh
TLSH
T10A13F2D7D18CC8FCA62D01B9EA15FB847F17211BDD99CB1615B0FAB9648BA62310F5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 178KB
SHA256 0dce730051c3b1526526743fc0079505bdf5454b79f6ec1c1fb2a7cb26350694
MD5 c0254118e3ebe12378022bfef999912f
SHA1 8ac9051c56091acd2b31036d8cd37bcf2f36aad7
SHA512 2014dd6332c3b1e6e4691533e88e66651d227cc8091274beb7aead5766bee626d7332b90328b46c7a19a5874ce9d2db52436799af9ab1448e9aab7ae4139d636
SSDEEP 3072:f6pPcK94Pdr1Il6r0/2TDx3rIYZ5gX5GaShNqIXIzmp3YuYb8:fdK6Pxx0/2TDx3sYTgpGX5IzmpIud
TLSH
T1A20412816BD0A4C5342CF6C5CAAA33FC845955E4B2DE4C4DBA3ABBC90670DA7950EE43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 66KB
SHA256 83ce25d1626b9df8128322c9674046eb4ac35b4eb01df3d6f53f36f549e917e6
MD5 88e53983d957419112b25a2e0dfca15b
SHA1 056f51187ebff3bbc1c584c3cc20cc7e49314542
SHA512 a0504487ab2bb790034d5e7a578b82027b01e66121c8b96845c04b07d8257ff707c7f29094a2ef886a27d2d10490ebe1d0fa465e786b760fadc1fc0a805ce76f
SSDEEP 1536:j/JyOil76sUn1aHVSWnJdy3/D/HUQ0+mYY:j/J3/nMW3/H0D
TLSH
T15E63029698A1C714140F4DF862BA31C11D1EC868E7FE8FD4156D008EE5DB2AA78DBDF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 75KB
SHA256 d36ddc293dac5f9d61a5955a2aceb60e67e4032b72426f8ff2fee77cd348a79b
MD5 68d57064d114cbbbfc8fea472803434e
SHA1 8aafa5d15ed0a4f1d42f83bfd7b714794ebc5399
SHA512 e6f7b6d235177ec1626dac2424b211c94e06af3f96a145ff2fa6222288474364cb578ee914ed30d5375087e41df56cbb379d25fee2c48617d5fbb8bf84736661
SSDEEP 1536:hqfhLTkIKY49Uc+uu2FNkzHuBh1O12bv8WrP3PmTy:u/RuuFuTcSb+Ty
TLSH
T19F7302AD67D2C8F94FBF7FD4D20A1401EB949A7EFA22418C4B939D895B99206743F043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 100KB
SHA256 f3f9d73fa829a0e5be5ce14e88fcb11c209fb289861b74e21240717b7e780108
MD5 4a46f0cc5ca5e4adec0037d2bb8ae737
SHA1 66dcd2f974de970a38f15753ea56a2c38f371cf7
SHA512 d6a3610c21831bbd8091ace1684dd835a94381e994eb8fa369e63272c74b5c54469ab936ad8c00f25d04bd255ff4833f110483cb4fde912e4fdffd790a9010f9
SSDEEP 3072:3X/FGyNF6dbA6XsYclRGUv7DEganS25TpVC:n/FOdsvLvnY95XC
TLSH
T1D8A302DCD6B43B2309A00B6A19C454F783CBFC5FBE3AE4C82975E188195852DB788E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 105KB
SHA256 d680fda14cbeb7d1e353c252cd79d6fc73bb33833f9eaa3a3753214f452e7dc0
MD5 90f46b6825df7b43a5d693a1c9b2bf2b
SHA1 4d9b48388f72a78ab06523c75be054e344164267
SHA512 bf20c2a004d41afb5d771a121db14c84e6234848b7819562cef239b49bf45e79bf03588ce62299dadbae2f9afcd79ebae0851d5a92766c35b963b0401d23b546
SSDEEP 3072:NJ80HHrgEsHpjZ5xFhTipUAsAV8tI4TWXAPJu6U:NO0nroT5x2yk4U
TLSH
T1D9B31239A8E2CD1BD62D78BF4CB01E50BB16DA0F49C4012AC0D15F84A9599BB3D7B58B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 140KB
SHA256 d526e23b94513738f53e9a89b2836244b3c8a4d6e98f7d4138d4415ea0ba0ac7
MD5 ecf93a38f5b928c85b224dc584937e87
SHA1 e2f851a008dfb83bce7e0f4f2fc07310cf81735f
SHA512 e8298baa84b23e2c699f08b526c4fdb14542da11a82f865b581ebee20fa32d1939180b3cbc563fd1b12cd0e923e4a0538703b884d12c792decac221699613a5d
SSDEEP 3072:WSJeb3mZx9U3mZmZrh4qi1Eaap4cM0xpVB9Cqw/Xmu:SzmZx9zqiOaap4CXrw/Xt
TLSH
T111E312044F7716B139FE3EE283927A9F9248BC0BC91278614A9114EBE4EEE5975E143C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 219KB
SHA256 257941e9f6ea7081314fbc03a16740d1401f5b020552a46b2e7b52146cacd1e8
MD5 5c4dd87cd84da0b2b274b482a2e0b94d
SHA1 0d9fe8886c864830dbdbad6af8d2cf05a36933d5
SHA512 c3d36aabf9c9dab886145c519c8171a83cc52a471ab175ffc28b6ed7cb2387ed32b07824ac94589e45d4036a6120655d4c90095a0e6e8b549921c02ba98c27d0
SSDEEP 6144:lz49qsDW1Cuogxuh5kiY8DG9y+oUUY+mz5d0w:lc9qD1Cfouhi99roNY+mzr0w
TLSH
T10E2422AA8F174848F95907B131305C960AB6DA6ADD52BE059CAFC12B9B5C377C03F3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 224KB
SHA256 dfa4b0cfd06afdfc561f0bb04955c32a748cddb96a1fef5d758f767a5dfdc8b6
MD5 48fa9642f612b27eb46ab6f55762870f
SHA1 a1b509b5e80670acf51e7ec7827a1c2352b5c1f2
SHA512 12fc43cf447b67b054924501be6aaed7455ce066666c07d2158cf02fd9ab6bcdb504544679be66bf1f69048d40642a9efb667275ecb68ac77a9cec494511f4e9
SSDEEP 6144:dyALv7jJDobTIMdShuFL/nTIOl9XDVPADN6kTbk9:dyUIIMdLRnllvcbTbk9
TLSH
T11C2423AA47CC7B3448D1E053937AAD5E9512A4D56442D3D6EC3E09784CAF3C92E33D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 21KB
SHA256 aedf20e686057a988387fed0af6d6b436be12e8e410bdcc793026e0f5b35881c
MD5 ec4a83752270c6b741a0b4f159a6845d
SHA1 08712524bf183c2d362620f72cd647139122623d
SHA512 33dd8a778d949a6eabaf8c94f0b7cf086f6e8bdc5131b46c1562250bc3a17b60344cc2f8077caa8904669a64e0b2dfdf0665518af358dcbcafee410b08d1aace
SSDEEP 384:exTcBexoYv1L+h1fqVWbgnaXjIZ2pZ/LGmDT9ECfTMaaDlNQAQx1j1YV:eOexDvEiVWbw0jTr/64GCgaaJWre
TLSH
T184A2E124DDD045E7A88420753F70379FAC6C1CD8ABBD700152DE46D9B5F1C7AA8EEA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 92KB
SHA256 28de974db68e420aff9574b5fcb8c0eb942e400906eccfa09605bcac1128d389
MD5 ebff0d081ad5aa3e029a3e8c3f2fdf09
SHA1 bdeadc3fb3ab2523c4ea7bcee5324a1e77acab82
SHA512 95dcbe00be14ddb1643f51405347a395b6f9ee5432374e354cc8537f9ac3e3b5d240586ddf203765e829192bbdb63f90a348be87c64f3dc2d2379c411fd26e05
SSDEEP 1536:1hE3fMb2qNofLd4Iaf7kc0ciAYQ854fCiJtWWWd0gJshDWLw7lLZaiy/YTXOqhBH:HMMb2QoOlfQDrAYX54fC0WWq0cWn4pQ/
TLSH
T15793121489A54E6F0B78CA0637CC6903E2A147D0A13766370A27FCF215CDE74D927BB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51870fbfcbc05a52_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\51870fbfcbc05a52_0
Size 416KB
SHA256 4724c0d0270ef0fb3ded804fa8465154928672b3206e4f5c38164d96676c5b37
MD5 6e8cd571314c87db43e9657102e60996
SHA1 abc4343d85914d70c9d0067828098a9be55181f6
SHA512 95a372accd6bbc302996988752c3470121a71d2a32fc1d2c80c8bc08d80775417bbe3a3bf7bac5752019ffc472e61818423dd6aa3b2b9f72aa9a234685959307
SSDEEP 6144:54g0q9dcjaaMze06U53hCGVJuA1ynzCuX0jC:/0q9dcjaXJhCaT1ynp0j
TLSH
T1E794B4495790F995CB6623F445A28953B731844C2EC3E32371F8F73A3C4A2E55E8A98F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef72bf187bf0a863_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ef72bf187bf0a863_0
Size 376KB
SHA256 bc040bd10db83c0321380c7795a53c2dd24fd1d8256fe6fb7490722b6cc763d6
MD5 0824d7d52d095bfdf29ad708762c29e6
SHA1 ffdf52fa0a23ee7d0bcbbc8674369d677fcbcbbd
SHA512 fa36e4f6b6e4cd4f81b049d94d2ff10bd076d7ecf5569a3c137176f2712791289cf2630b411030655caa6b953394ed1034f1d31439e25f685e71d315f171df7f
SSDEEP 6144:PCW9U9HBw0kZ2bJtQXSOXiQf6bufRhAW3ArIAQLC2apZWNa:PCW9mBw0OX3TX+Zm
TLSH
T1E584B5455B90E965CF7623F501A3C952A73584446EC7EB2370E4B73A3C4A3E25F8A88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3f0da9cd3efde283cc229a9b09a41d18e144dae59768a513ee23d6cb926352f4
MD5 838041291fd7ff35f044af1c21a95e17
SHA1 40a5d001e8ade9d97f61435ee41b27d9cc3086fa
SHA512 b27b8b92b06beba0286f5ebd7e7b69f17364693af47bdc895ed0ee937994926d4593daba7cdaa873988d0ca9e8105f79e7ad0a5707a62ea53b8904a1691ea712
TLSH
T13A31BEF3C6E85A3D894146F87B153E2BCE2D0814432C3E5AC5D4AF5FA7E1871D29098E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 87b322b457446cb3440b5d6ce57317d8c7879a56e781628d08ee23a05e1e1735
MD5 93f4cee7551b13652b7fc1458a71c196
SHA1 674f09d55a1b76824f81093b9dd44660d5c98bcd
SHA512 de957cf5837a8ae1a989fb9592786dd5acc1755e3d110360a6545196902d89b4ac38af3de4ff3e75e75d0ca1c2a6d09845989b1be48c7e7361adfaf5217f4cb4
SSDEEP 192:sxRfR3C2/frsG6Dde5lSSzoD8pMekFWHg6+WNsIX9rsZYB/oiuOfGOIgVNJ:sxRfE2/frsG6c5lF+c5b6ZkPJ
TLSH
T1CE42EA5669389D7B5CD7E219FA16BF53D2F9203291E01E44E7FC9A1C04EB6DE220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6863ab8fbb6cb0da9f1e21afb7b87987d398232dcbd8ad496df86b5e7955f66c
MD5 b5bd6172cad33a84edd6889b3245d54d
SHA1 e132d5d79a2f23fbd10acad40db98d009ab7c794
SHA512 8ffdf8cabe04422f8e0ec8e28a906aa077c3316e5b03c3c6522b9cab6174999a06ecf011fa7a0c2af60ef27f01a75a3774534b4677ed6a0ab21c9b5b0eb88bf5
SSDEEP 192:sxRwR3C2/frsS6Dde5lSm7zoD8pMhcVJFWHg6+WNs+Tdi4BYB/ziuOfGOIgD1NJ:sxRwE2/frsS6c5ldRc5l7BvPt
TLSH
T1DF42D956A9389D7B4CD7E219FA12BF53D2F9103291E01E54A7FC9B1C04EE6DE220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 778db82743598d53560dadc89902d10a8496b27a507e6bb5750fed144a77a87a
MD5 340f151e80026ef4e04c31000c4a76e1
SHA1 a768d6667e3491db684469de1cb260204a01cbcc
SHA512 ce755820be2d51bb88c1efee8e16b12d3ca233e79e9862a4487da1fd67bf92b6268994639b5711b62338edd36b40b22d65a5e592c7ec6f416a99a1938fdaa849
SSDEEP 192:sxRwR3C2/frsSzDde5lSEzoD8pMFcVJFWHg6+WNs+TFj/9i4pZB/YB/j2uOfGOIQ:sxRwE2/frsSzc5lXZc5lFb9/1PZ
TLSH
T1D752D95669385D7B4CDBE219FA56BF53D2F9203291E01E44A7FC9B1C10EB6DE2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d7332ece9326e6c455e933b90f33ff05227f447233194036659638ba92e176f1
MD5 0f80821a5a315286ecc59f15edd5514c
SHA1 fecbe018e3725a883762ab8db6bb27a87631e6a8
SHA512 d24c0e0fe315c5f978e9879c23b83e7689fc432f88acc304ddef2190b6ca64d0f1088a83ea67e65d0d89ed76d566ddb13487270089dcfb2900f04cbf7f4b89ba
SSDEEP 768:Irv+4UNbdD3VcuNp8+p3bd66j+4BRv86aLIiL2bwCl1:Ibsbp31L8+p3Z6n4yd0ww
TLSH
T1A103CF73F8A899739CE6C644B2467A433FF861A396C10AC4D4DD2B4E419B19E230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bdec6ed2519a7b804368d0dbcd8e995e8c0d7e1ad675dc5170a86ff6dae5d902
MD5 72a29810d13e829258ff36f6d275071f
SHA1 6a81da75c883fdcebef4af30f9e4846f22b9460e
SHA512 2320e2b1c291332920ea0fa22ab78c2961e193ff2f21761afa9f75d84a64f26aacdf061cfd11743d80f905b681eace28b89fb084ddeab0d9bcbf7230f690d1ce
SSDEEP 768:irv+4UNbdf3ube1np8+p3bd66j+4BRv86aLIWF4M:ibsbF33p8+p3Z6n4yb4M
TLSH
T13903AE72F869EE339CF6D644B18737837FF4206395C00D98D8D96B4D419A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ce5db421481c47a6ba65ed3752892b8a5e22aee1ba337249e53ed5e64ab45d5
MD5 41f513878f00a31412b9ee0047150e34
SHA1 9c5b11d7297e2e24b22715184b0f02015fd37fba
SHA512 2e238b609d83783c41541e6ed644427ed6ff91d6fca444bd417dd607449b7cf1fbc7398b8633511f68b719b1f1f319a535e4558c8347f25219605c2f5aee75ee
SSDEEP 768:Wrv+4UNbdY3/r01np8+p3bd66j+4BRv86aLIWF4V:Wbsbu3Ap8+p3Z6n4yb4V
TLSH
T1BF03AE72F868EE339CF6D684B1873B837FF4216395C00D98D8D96B4D419A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 62afeffa7cebfea6deb6066ddc5d4ba19f98315914b9d0a1e76a31a5cc227f34
MD5 e637bda3edf225d7d5e85ebd19b9b567
SHA1 e3075cd25ed852a3e1fb1ecd6f5062d178d4aed5
SHA512 2aeea8e2add78dbba27ac8bd8c318773afd220db347be41d65b80e028196c22cb2cdce7eb567c1b0fe37c80860b7a6459f83603f3dd0fe5ec8e65ac55de22bde
SSDEEP 768:qX3/eQ1op8+p3bd66j+4BRv86aLIWF9Bv:qX3728+p3Z6n4ybb
TLSH
T157F2AEB1F8A9DD235CE9D684B68737836EF4616385C01D98D8D9AB1E008B26F170F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4af73e345803d3d54ae8a7edc14b3917f0760bd7a1f5e315fd6f71433b247de2
MD5 5984a6f5434538a349db95b59e319c0b
SHA1 78e80fa0115c442a900eaee1a529be08e74524de
SHA512 b9511d26f620f5a3875a7e8f93cb9d44344212a7bc13f73b2c6c130e9bf964674c09ecf38f742eb3ebfc3e43c22c31b6bf724a7d1eff02fa7b150fe4d76a4190
SSDEEP 768:qR34QK1op8+p3bd66j+4BRv86aLIWF9Bv:qR3Y28+p3Z6n4ybb
TLSH
T17EF2BEB1F8A9DD235CE9D684B68737836EF4616385C01D98D8D9AB1E048B26F170F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c62ad8590c7da96812fc0771d4ccc6bce4a99462ec53ea9ac3adfaae05ed2c9b
MD5 68cd373a594b4126b0b9026bf7dffa0d
SHA1 31b68be648f7d361b1d1c78f8a84dbd93fd69a36
SHA512 210b02c24711f22bf800b4085fc448f8ee747b31e5bc95bffd30d3fc299cad5ba43b06d89f4974f32ff15ab3ac9dd0003e1b738795297ce98ae0d5605d1af9e4
SSDEEP 768:xrv+4UNbdD3Rk1Np8+p3bd66j+4BRv86aLITF2bwCl1:xbsbp3KL8+p3Z6n4yQ0ww
TLSH
T16603BE72F468AD339DE6C644B1877A837FF821A399C10EC4D8D96B4E405A25F270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 26db7aeb9dfae9c5c163e8234704088a7d35ad1dd0ddd457c8a515e0546e06a1
MD5 2064552845bc7a38a1ae7f957b67faa1
SHA1 baca7499db00b7e31a56d6d783d6d956d39677a0
SHA512 862d039a2a50d79a6a003487c6451cfc325da29b44be3763b670f46724b020081926274524b7d3b369594032b182c22e820d31ecb88fe308a7fbd1fd6dea07ae
SSDEEP 768:qw34Ak1op8+p3bd66j+4BRv86aLIWF9Bv:qw3C28+p3Z6n4ybb
TLSH
T1BAF2BEB1F8A9DD235CE9D685B68737836EF4616385C01D98D8D9AB1E008B26F170F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a4103f76846fe2d430ff0cba8af54acd62e880d52e13258dbb70b805f4fa179e
MD5 1e94f4b4738d7e106268caf27e599427
SHA1 a4981bdd180266fc3b1c0f16e640c3b5313f5780
SHA512 85c1a6404ff76b0ee9264b4492ba8b8c1d6503174618fb47d159d8f7fddddb8d1b18718df97d4c47e69a47d726fd590405a57fa295244613acb104f51deb3b9e
SSDEEP 768:qM34Ya1op8+p3bd66j+4BRv86aLIWF9Bv:qM3I28+p3Z6n4ybb
TLSH
T10EF2AEB1F8A9DD235CE9D684B68737836EF4616385C01D98D8D9AB1E008B26F170F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 02b49fc612cb1a139f2e5c958b81a946c7809b1a232effb5fe56c50fd8272b54
MD5 6d2e3cbc7c71de9c676c82e7cfef17f1
SHA1 63a2c9bff7fd689fadc5b30622b79eb393d094ab
SHA512 d870527eeb2cf57a6a65ea0fe60c75d05973bed280598d36081b1d1b7937c70921a0144b99ecb5ba5a89afffd0e124b3e174840b1f5312f59bf5b309e40b2b84
SSDEEP 768:Qrv+4UNbdD3UW1Np8+p3bd66j+4BRv86aLIWF2bwClW:Qbsbp3jL8+p3Z6n4yb0wT
TLSH
T11A03BF72F4689D339DE6C644B1877A837FF821A395C10E84D8D96B4E405A29F270F937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7f9b337-5c0b-4bc5-a81e-c19f1cb92ceb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7f9b337-5c0b-4bc5-a81e-c19f1cb92ceb.tmp
Size 33KB
SHA256 721f1c6f9977f9aa58551c62fa6c8e02cc7dba1226500dacb9f36e8cfcabdc7b
MD5 96ba1b4a9b0b0f26015766f7e8bbabab
SHA1 7f0442ad27774adacf5e8029c801daf52814bdfb
SHA512 836fe305b9891c652be19f797b3bf1884d8b20e3b73a3d5379af7c8b162c7f7504dec23f3717be230c9026b58379d412a0088e1582895426df25864032277146
SSDEEP 768:qM3/si1op8+p3bd66j+4BRv86aLIWF9Bv:qM3328+p3Z6n4ybb
TLSH
T13DF2AEB1F8A9DD235CE9D684B68737836EF4616395C01D98D8D9AB1E008B26F170F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1e2a63c-5e5c-463b-af4f-50464b01d3c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1e2a63c-5e5c-463b-af4f-50464b01d3c9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI28682\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5vd2tj97.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\25zi930c\5vd2tj97.exe
Size 5.4MB
SHA256 6bbd18a72ea35bbb3b523e6c6e4a6d538b14300ad4d6c93670af52e0347696a6
MD5 92a36d0ac99c8fc1298e45f10ab52133
SHA1 fc3cc82356e55bf11ea960dc6460aca7b4725a86
SHA512 f40200000233078af2fb20ddca1e2d0092570580a7948b84eedce43fab13187bd92a0c6750bc08202d6c16398bdb8437f3fe71b16fdcb284c07d85eb556074f1
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrZ:k7ICteErownP0oTcMsABqlkgczF
TLSH
T155463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6684-1225-0x0000023D2F630000-0x0000023D2F744000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads