f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce

Analysis

max time kernel
8s
max time network
69s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
Size 5.4MB
Sample260831-abvmlsbm8s
SHA256 f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce
MD5 01bc145fc5c06494b1f0bf1e8ebc9013
SHA1 ce8623254f7916da8ed74bbc5e01f6cca9f81f84
SHA512 e173537afbb6d28d738fb40563775dcb2b4d9a8565085e3cb81d6451246408329cec247de18d3bbd836f2685e772a53066e991f62c6946c3826ea2afc9db72d2
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrY:k7ICteErownP0oTcMsABqlkgczc
TLSH
T1DE463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ssk6l.exe	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3ssk6l.exe	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n8wq82.exe	x7dokzgz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\n8wq82.exe	x7dokzgz.exe

Executes dropped EXE 2 IoCs

pid	Process
2168	x7dokzgz.exe
5504	x7dokzgz.exe

Loads dropped DLL 23 IoCs

pid	Process
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe
5504	x7dokzgz.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\j3lde7q2\\x7dokzgz.exe"	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\xxb0qzxp\\ohuk12iu.exe"	x7dokzgz.exe

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
126	ifconfig.me
234	ifconfig.me
410	ifconfig.me
520	ifconfig.me
629	ifconfig.me
1994	ifconfig.me
2424	ifconfig.me
554	ifconfig.me
756	ifconfig.me
1487	ifconfig.me
2368	ifconfig.me
128	ifconfig.me
303	ifconfig.me
340	ifconfig.me
373	ifconfig.me
1041	ifconfig.me
1764	ifconfig.me
1	ifconfig.me
796	ifconfig.me
2395	ifconfig.me
178	ifconfig.me
907	ifconfig.me
1258	ifconfig.me
2562	ifconfig.me
222	ifconfig.me
243	ifconfig.me
323	ifconfig.me
1408	ifconfig.me
1759	ifconfig.me
1766	ifconfig.me
1950	ifconfig.me
51	ifconfig.me
87	ifconfig.me
980	ifconfig.me
1045	ifconfig.me
2353	ifconfig.me
2586	ifconfig.me
85	ifconfig.me
168	ifconfig.me
371	ifconfig.me
1285	ifconfig.me
1914	ifconfig.me
366	ifconfig.me
1229	ifconfig.me
2000	ifconfig.me
2295	ifconfig.me
100	ifconfig.me
109	ifconfig.me
164	ifconfig.me
376	ifconfig.me
2554	ifconfig.me
274	ifconfig.me
1212	ifconfig.me
1269	ifconfig.me
1842	ifconfig.me
2276	ifconfig.me
272	ifconfig.me
837	ifconfig.me
1055	ifconfig.me
298	ifconfig.me
335	ifconfig.me
625	ifconfig.me
2103	ifconfig.me
2359	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2744	cmd.exe
3092	cmd.exe
800	cmd.exe
5400	cmd.exe
4088	cmd.exe
7324	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5480	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe
472	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
472	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3444	4592	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	89
PID 3444 wrote to memory of 2744	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	90
PID 2744 wrote to memory of 4108	2744	cmd.exe	92
PID 3444 wrote to memory of 472	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	93
PID 3444 wrote to memory of 724	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	94
PID 472 wrote to memory of 2916	472	msedge.exe	95
PID 3444 wrote to memory of 5456	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	97
PID 472 wrote to memory of 5480	472	msedge.exe	98
PID 472 wrote to memory of 816	472	msedge.exe	99
PID 472 wrote to memory of 816	472	msedge.exe	99
PID 472 wrote to memory of 816	472	msedge.exe	99
PID 472 wrote to memory of 4616	472	msedge.exe	100
PID 472 wrote to memory of 4616	472	msedge.exe	100
PID 472 wrote to memory of 1088	472	msedge.exe	102
PID 472 wrote to memory of 1088	472	msedge.exe	102
PID 472 wrote to memory of 1088	472	msedge.exe	102
PID 472 wrote to memory of 5092	472	msedge.exe	103
PID 472 wrote to memory of 5092	472	msedge.exe	103
PID 472 wrote to memory of 5092	472	msedge.exe	103
PID 472 wrote to memory of 5228	472	msedge.exe	104
PID 472 wrote to memory of 5228	472	msedge.exe	104
PID 472 wrote to memory of 5228	472	msedge.exe	104
PID 472 wrote to memory of 1688	472	msedge.exe	105
PID 472 wrote to memory of 1688	472	msedge.exe	105
PID 472 wrote to memory of 1688	472	msedge.exe	105
PID 472 wrote to memory of 1608	472	msedge.exe	107
PID 472 wrote to memory of 2784	472	msedge.exe	106
PID 472 wrote to memory of 1608	472	msedge.exe	107
PID 472 wrote to memory of 1608	472	msedge.exe	107
PID 472 wrote to memory of 2784	472	msedge.exe	106
PID 472 wrote to memory of 2784	472	msedge.exe	106
PID 3444 wrote to memory of 1876	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	108
PID 472 wrote to memory of 3536	472	msedge.exe	109
PID 472 wrote to memory of 3536	472	msedge.exe	109
PID 472 wrote to memory of 3536	472	msedge.exe	109
PID 3444 wrote to memory of 3064	3444	f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe	110
PID 472 wrote to memory of 852	472	msedge.exe	111
PID 472 wrote to memory of 852	472	msedge.exe	111
PID 472 wrote to memory of 852	472	msedge.exe	111
PID 472 wrote to memory of 988	472	msedge.exe	114
PID 472 wrote to memory of 988	472	msedge.exe	114
PID 2168 wrote to memory of 5504	2168	x7dokzgz.exe	115
PID 472 wrote to memory of 4040	472	msedge.exe	116
PID 472 wrote to memory of 4040	472	msedge.exe	116
PID 472 wrote to memory of 4040	472	msedge.exe	116
PID 472 wrote to memory of 5984	472	msedge.exe	117
PID 472 wrote to memory of 5984	472	msedge.exe	117
PID 472 wrote to memory of 5984	472	msedge.exe	117
PID 5504 wrote to memory of 3092	5504	x7dokzgz.exe	118
PID 3092 wrote to memory of 5128	3092	cmd.exe	120
PID 5504 wrote to memory of 2340	5504	x7dokzgz.exe	121
PID 5504 wrote to memory of 4196	5504	x7dokzgz.exe	182
PID 5504 wrote to memory of 5316	5504	x7dokzgz.exe	189

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7540	attrib.exe
4108	attrib.exe
5128	attrib.exe
4580	attrib.exe
1008	attrib.exe
3364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
"C:\Users\Admin\AppData\Local\Temp\f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe
  "C:\Users\Admin\AppData\Local\Temp\f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe"
      4⤵
      Views/modifies file attributes
      PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffa561ac188,0x7ffa561ac194,0x7ffa561ac1a0
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,1424416855041809215,3958944549917179540,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
      4⤵
      System Time Discovery
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,12573609647419143637,5792322793632239563,262144 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,5595221834509406242,5419333619908114996,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:13
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17292816481137748935,14626194681146783865,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,10931419319826377193,8820498496397185858,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,1594476330781441576,12609930740891737842,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,2517935098352532037,9837567744383516968,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4328,i,10696784646933690369,12351671484635165540,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4556,i,15910918320025839886,5679872332945085296,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5608,i,5580386987477545243,9113596013985035274,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5752,i,18114963624271152904,5151370907071555481,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,15239227625142290162,10813914130085408560,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6096,i,11256318035048988426,6216849680616888343,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6272,i,4611758224305614578,17536131697506917736,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,4185269281187685285,1238343345727386106,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,4185269281187685285,1238343345727386106,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,10716005814613158603,16987366074906599531,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6584,i,6323085332730347685,12312804123014860156,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8409567207986449451,8573310565896344004,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6612,i,4862991850244917245,15271415977234962703,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8020 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6656,i,8931098190139916800,5912729815640223251,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6824,i,14524749974924702696,980329706307940550,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8068 /prefetch:1
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6632,i,793360571088886352,9716105758109384226,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,14454383328273880531,9904179577394254478,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6676,i,11868354370247292694,13740014581203385781,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7424,i,16655732213945042187,1805405013847388258,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7488,i,12413533687825435423,718277308742687524,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6876,i,14886957383363713209,12519799067480058654,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8088 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7348,i,6721321492790064271,9483300528318006817,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5972,i,13445153407772305909,14472202432674364954,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7396,i,5803561783334766605,10098301827935914906,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8196 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6000,i,17869052857737737531,4365250174078871621,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8228 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7428,i,1692848642816362916,587493107413777583,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7492,i,12657084442765165427,14099520793245052513,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,5825305841165985384,4546721086757362428,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6016,i,7608320557623137288,12921176983684815544,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8352 /prefetch:1
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7672,i,8140650408256715242,16356727838344472675,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7516,i,13746324950160170828,1823988595449747053,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:1
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7832,i,6955457013039542569,7993089388351863060,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:1
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7292,i,8690731883362337297,9572996964181024228,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8108 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7296,i,8671202056104271053,12551771454024884214,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7420,i,18076158193326783193,13404224714456764074,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7856,i,10631533334005054616,1484283906960259825,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:1
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7780,i,14689060931119514962,5056371066068972470,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8332 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5528,i,17251334787420353983,14080180101131855903,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8816 /prefetch:1
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7864,i,15320282796846091783,4770660176904203716,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8880 /prefetch:1
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7904,i,14190693132884966254,8330066798081911086,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8952 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7924,i,7380152846163478971,7224968351793480432,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8956 /prefetch:1
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7756,i,4277811642338388167,12694300393820876995,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12352,i,5400295519684156691,17907112519221216444,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:12
      4⤵
      PID:6636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12392,i,14385385230431347108,853623806866594290,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:14
      4⤵
      PID:6936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,12176851129070359580,12396602896532733641,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=9544 /prefetch:14
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=12404,i,16200220106852704646,1307870255442777872,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:14
      4⤵
      PID:6944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,16610101969102226625,9148037181432690222,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,9693607108266137041,11052479519315897280,524288 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=11184 /prefetch:14
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=12380,i,6777197749919746248,3412347335991471683,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=8828 /prefetch:1
      4⤵
      PID:8096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8172,i,10859959737848452683,718405576356654339,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
      4⤵
      PID:9344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6616,i,10353304564842804889,716286661309594251,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=11188 /prefetch:1
      4⤵
      PID:9500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9376,i,11204311344101346724,848412247279031797,2097152 --field-trial-handle=2644,i,16653193974198659758,15478429113070764037,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
      4⤵
      PID:9608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe"
      4⤵
      Views/modifies file attributes
      PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4344

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe
1⤵
PID:4132
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xxb0qzxp\ohuk12iu.exe
  2⤵
  PID:2180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:800
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe"
      4⤵
      Views/modifies file attributes
      PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1644

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe
1⤵
PID:3932
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ah3azmo1\axapvkly.exe
  2⤵
  PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5400
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe"
      4⤵
      Views/modifies file attributes
      PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4748

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe
1⤵
PID:3624
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5ij9ccdo\vpx10dlh.exe
  2⤵
  PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe"
      4⤵
      Views/modifies file attributes
      PID:3364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5028

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe
1⤵
PID:6332
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8y6mpz3w\9660mq05.exe
  2⤵
  PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7324
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe"
      4⤵
      Views/modifies file attributes
      PID:7540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:10144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7468

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe
1⤵
PID:10120
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\d1fe14m5\mnbmctvx.exe
  2⤵
  PID:9248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10716f42-2e01-4ed5-9247-a19ded8b0532.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10716f42-2e01-4ed5-9247-a19ded8b0532.tmp
Size 39KB
SHA256 4645fbb63d324365174e07340383dce4a2ba4166706253f828e52f04e33eabc8
MD5 43a5cbcc5e8a9e0bc697884d9e3f9ef1
SHA1 135415e055140703d75d36529478696498436347
SHA512 0427dff187c6e1d8f6a7ad312ac9c13aa0602bc4dc50a86ec02add99c17762fd29e78683a7fa5441567aaf70ac88e48913780327168bfd60b294b9320835e92f
SSDEEP 768:Drv+4UNbdS3OWElYyBgyk7Hucys6BRvi82oP4/z6himofk2bwn+h:Dbsbw3aR3imOz6Imo80w+
TLSH
T16603BF35E4189D73EDEBC188B1467A937FF4626344C90A80E5DA9F0E5187A5F231F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 75KB
SHA256 3b4b2fc56d46b5c95f4d2a790b21221bf4d3cc3e6c14ce66a2e2c249da27ff26
MD5 84c6c466a288b666c9e37601b684e27b
SHA1 5671728eddc4cbbe6e6847e0910a7b1fa08e3d93
SHA512 e8d093ed618e1a909794d9c3c117accf2bde6729607a677c0744dad6a0a8a35b8e60cd45bbbc5fdf8b6e07882f30908364113637b9de105a276b29142f693ca1
SSDEEP 1536:CrNnWXhhcu0kiKWMGWHO/B3VOPE5tZpUF3zNJ5MHHwbYoXLjSh9cEPI4nB:CrNWxh70LKWJBFJZpszNJ+mHj29DnB
TLSH
T1707302DBB407EF1FECFD5BD64A2A0D838B1F5B222681444B30BD49F6E379E942448295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 17KB
SHA256 ae2195ac96b260eac6e79ad8f0065fcd1c0f972831c6b6056b513c658d53dde3
MD5 099367d5e4b37301d4cf62b9a486be65
SHA1 60ad34a9b94162379f5573684bb626f5fef07f89
SHA512 8d8ceec8ba70f30380a3ce89f26f92ee0b1538d665d64edeae25965a9e098f4bd7db895d228accd31f2e7dcd80cfdb2b943f9e89d4fc168478bb1d8322024caf
SSDEEP 384:8aK6SZPx9KN47OUAcDLijw0JHiFOnMBzC/koLL3WYMc/Q9gX3reUSZ:DK6SZxgNtXTlVOzC8a3bbVnr0Z
TLSH
T1F982D140246227B4235162182762067F1FBCED3B9A3557636C33D96391501E7B9C2E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 26KB
SHA256 debf72e3ca5b222e6e0adfd3dcefcaafb137088fe6f76c515ddbd77e3a9acdae
MD5 49b05b470d91a1d31032e2475c96fb5f
SHA1 0d5c6e72e33ce0e9c89f47dd222bcb6a971584cf
SHA512 803e6e988fd55a636d3954906f04ace3247ed8a1b11c7b77973b4786cc81fa2b559ca10313021e3c0ab925a26a0baf793c736eb2994fd13417ff6d82da04c8a0
SSDEEP 768:WU7TH28Gt/+2cioW1SjLAbTQc70fIkOc5KvZcYT:vTHWh+2e7sTZQfNVKvZcYT
TLSH
T1BDC2D19BF101B6B1B0A350CB67B5C225C13C169E2FBBAC1535A19C728DCD51FCE70695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 58KB
SHA256 dad1ac4d1a93c01b7eec003e82943c1afe3f626245452eb8cf3628442917f067
MD5 38504a8d16ced08fbcfb85bc8bd41e11
SHA1 ffc6425bbbe9104ed2a6c6b3998769e50e33b8e9
SHA512 848b30203458b89e681d1d2e57a1305e0cc8f0f934b2234664a9fbec9ade1a48f3b95424dbc86bc1294e0ab8544352e6d94851f206cf2728cfc60e48417cb322
SSDEEP 1536:ZZ5AXCZCh4v5tpCpTYVL10qS1XIoPlRW5XYNSaIJUJpP24:ZZGlkNCpTWL1anPlEXYzPL
TLSH
T14243021A6CD8C2066773B013A3E82CFFDDBF1554AE4DBD5B061462D92A11F8E68244FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 75KB
SHA256 42476d62af3b4413b94286bbfe115916d356c0f5ac83f8402ab1636d51481572
MD5 b6dc8a30957bee1ba22642d38cfc03a8
SHA1 a8690459f947bf5609964cb3e965616c82cb6bb3
SHA512 4a12bb1edd279dcb409f620a31b20e4a122dfa6e9f8b673c656a4c6f0d479abb0038062bfcd13ac5173d3596db17e5b6d7c5ec07dfaf01628a1d1fd6dbb5bb94
SSDEEP 1536:aeR0PvNKsu0VhZkm08HYSR2CwYHg8tGpo7j4xdD3tKUMad5Cio/B:a00PvNKsu0V/km0cN8CwoZGpiCdJKUDG
TLSH
T18E7302171FA847860E70057625E0204CF324EB93A95C6DA4D82335F59DE4F52AFDABF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 77KB
SHA256 41acd2efd8e29c20f6b844089809f8cbbcc954d8f693e28ef7b40e2f3826036b
MD5 7d509e7fa7d4be9fbc2ec1a04f7a3d56
SHA1 8bc9948200f3444acc7a9cffc7371d90339616ac
SHA512 125b640c02c82b5a7ff8d1c72e77e898a0249411c5cad5681d88cb148f156b296bcfa54bc884f741e4bf097fe849c1ecac46d50d12844509857e5f4a181429de
SSDEEP 1536:whvZpzCjpXBUK1iTSb9LYhoGV6IKXRWvv7aWOyShODpaYiZZQyQ:gzOpXB0colKhWnbPShAMayQ
TLSH
T18E73024D3514C312FEF89C89635344CAD50AC2DD5E9DBE2A2025A087D2FBEEA9DC0E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 108KB
SHA256 1ebdcf7fd1e5701a80ad02320f0b41a2a51916d8f68f1e95d986817d06f9ab6d
MD5 6574ada9efaa860e475129d2a418ca82
SHA1 2afe55819378db6a0b2d82285ad0b9e86e60f2d9
SHA512 e75cc9e1d83e24e79cec22983636f68575d96882eed5f9023bf0ac653624f6a5a9e853af68402ac8cfe8bc6ba17a5ddd5b5a56c25654cb4dc8a7684c839bb36d
SSDEEP 1536:totBJWbHihMYJT6l6c0rqReFoo+qJL0otK+5gstgdsLXI94VtVZOwxzGr3y5isU:ePJW2hMYpNrqRraL0otziVUfIaCjy50
TLSH
T15DB31284FB3116456B4A4E2E95F69EA35EDF2803209F032F3947BDA2117B1E943EC958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 281KB
SHA256 e1d516eff19f4811379aafb7ac93e919727d0cc3cb497b3b3ad07c0f80ea459a
MD5 0fce6d678327af8f066d9432a82d6c76
SHA1 16189408fa2d4e39c5d735797b59d2a48f15ef36
SHA512 338152a00f834335bed3b76b1a480f535b4d69c289fe96fffcd71953c1335f8566929e3b42d0cadf8e033128af2a1ada0e0972b6d05bb94ca872e8e1669d1fe9
SSDEEP 6144:18va6/yQTcefZMYxVoGfWd+sJYt9dQm4r3q+Rp3V2y3JsbHFVaOfjEzox:GmQfxMYxVo6y+s+tora+33Ey5EaOrh
TLSH
T17D5423FCFD2A74BD63F1B2A28CE61EA3B29D744140AD6BF47A9C4D067107DC0A512939
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 219KB
SHA256 f47090ae8b9141ef56703bdb58c6e944f4acbe890b8a71c70f9a65e1ed777128
MD5 2c7fdcc287cc74818ef49e715a045805
SHA1 a2f4993df4450593a2a7b821c0cd4230feff031b
SHA512 bee743fc515696d6966fe60a9e930520d66ac80434e44732fcc1e2a78996d766aee8c0c774717fa7cf329a60f41f8593896a8277e55efe7fb828d23ce556b68a
SSDEEP 6144:PoRBZFCrEMdEQcBplrkiyv1wTm2yOZWnwav6uT7gB:P8bYrEMdDYgieSXLZWnw56gB
TLSH
T162242342990D69484BD803FAF5FF3C449C5B5A09982B20696FA24126FFECD4E43F97E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

282bd5c2a10676c1_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\282bd5c2a10676c1_0
Size 230B
SHA256 1d5b013bbff13845aa777f562768bc626e0ea2bee215ca8848c8beaec4742693
MD5 8caa1207e13f51fe69d90f8914bf3a7f
SHA1 f56470f1d6a9d8ea2ad972ec72c8707552b8c5d8
SHA512 2bffd4d34e8756138b8d76e3a4e4202a053680da5665b880e8d1a48f64c2a0b6407f33b13bf0b204f67dca8923e716fce8645e4bb5cea254b193ccefe82f8b40
TLSH
T10DD0226FA90C8022CD3CDEF0CF3F329BE2A3901448EC41E2808094F33A0AB30BD06121
MD5 SHA1 SHA512 TLSH

Submit Download

3eda13d7bdeb22b6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3eda13d7bdeb22b6_0
Size 902B
SHA256 5da8d696f625ceec337b970d86e633136494a510af0dc26b744dffc7ec291329
MD5 f4d2296701c49798971249368213cce4
SHA1 335d85cfc2e23f4117cc36444441b147813b6357
SHA512 e318fbc56f40963fa962cd4a43b67c063ab57108e631472ae88d5194a3e88b0d6b441941a0a8c2306a417bf56eb173ea724eb9c4c10e48853487115e79d9465a
TLSH
T1D5112F1BBAB425BDDE5DAEFCC8FA511CC0FB522BA9A48169E934A0D06114DB1F8494C1
MD5 SHA1 SHA512 TLSH

Submit Download

629229c710528525_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\629229c710528525_0
Size 3KB
SHA256 26c90c91aecb5ac1c6dfd47caddac29f5ad8a7251e32ba6fc7939fa89bc38924
MD5 03c9ca467e8e87f4a0c1cb64a4b21539
SHA1 925c3c498f2759ea52fa7480cabc07a2809c7e75
SHA512 c0e6082604720ee27fd0827007550412463856f56f36bfb389697831cf6c104f749eb28c668c1a5510d369c6bbac87db4df71921022c34e851a82d36f4c836b1
TLSH
T1088139E1FDBD4F08CB139AFCDAA10871817DD0A857392C50D211A322351277A2B9DB36
MD5 SHA1 SHA512 TLSH

Submit Download

aef1ad0f2c24e7f5_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aef1ad0f2c24e7f5_0
Size 8KB
SHA256 e9e7f0004fc1cff5f2a1ae5a2d7eb0f7b49dd8ad1388f47d18311fe1abcc5fe5
MD5 e4e65f0b444068c06f65a1e8d4ff375f
SHA1 4ae8e92c24a8fd0c51acdbb1176d5d4caa24a939
SHA512 eb091432691d58e6c79cc6446317ae69c803bd70f56cd0450172a7e813bc37381ec9854fdf1d331f2b247d3e73d6627b1d2eaf70c3b51a3da85378f4d4b8d9c5
SSDEEP 192:Q0nRHKvyl0oql70RUh/cvexj/+3X+wVznEeOUCudGb+8M:Q09KCO6+hcvexj/+3XrVka8
TLSH
T1EC126C45F20BDF3CE6935A5C946900AA538F70542F8223C8510EC73672D6566DBCC6BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 356e06bdc6af350ca642728bda6e723d678e496a3a8318c9a4285e94da8ba482
MD5 73a8865656bcb4a6f5b65411a858de39
SHA1 1876579befff44b34d54101209d3930c6cf5cb81
SHA512 0a253945cfa4344e753cfb014d717d4714641ca4eb7e403f3d1916979c99023e6b50e938c58bdfe1bcb4ae8f284d4fdbb2003221a316a30dd87f51cb5c5ea9e9
SSDEEP 192:sxR/RbyM/jK1Ml8wCB/fEsrblqpq1zRNzoD8pMDCFjHg6+WN25mfYBT2bpkyGyI5:sxR/P8B/fEsrblq41p3h5RfiAy
TLSH
T1F962FA16AA785A77CCDBD208F6517F53D6F9503391901F48AAFCCA1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4f4469c0c0fb76cbfd9faec63dece00e5745d282c9514f5c54de3a7d066762a8
MD5 9beb6f74054f8416561974672a5f4d0b
SHA1 4b7797cf70a032000ffea0b993dc80d7854bd3fd
SHA512 7ece903e1f1bdeba071479486150b3fa7c87c085eeb563f9255d2f3caeec027868fa686b6b41e8f8f660de53938639e311c7c65367865fc749b683d68964e9a9
SSDEEP 192:sxRERbyM/jK1Ml8wCB/fEsWblqpq1zcNzoD8pMjhFjHg6+WNsiz9pFhYBThbpky0:sxREP8B/fEsWblq4Ap8h5hNhrAU
TLSH
T14862FA16AA745E77CCDBD208F6417F53D2F9507391901F48AAFC8A1C00E6AED611781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1c6be87fc8b7a83640cfff1e00979acc5501a3465b409055e09efa535f090a0e
MD5 b77cfadab32c86a07ee21f361abf09a7
SHA1 04cf6190501bd06e83ce7fc2794bbc9502ade3c4
SHA512 527c920bca07fa1374c86972d919a0bd5124979726cb931e9b0a4e8e89cc0f855f0e2ff99c8328c64d2e82b88d8447041c813f20a49cd7b0c3c6cfee64cf256d
SSDEEP 192:sxRTRbyM/jK1Ml8wCB/fEsWbldpq1zcNzoD8pWLjhFjHg6+WNsizlpl9pFhYBThA:sxRTJ8B/fEsWbld4ApYh5h9NhvAU
TLSH
T1C5720A16A9785E77CCDBD208F641BB53D2F99473D1900F48AAFC8A1C10E6BED620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 87520f76b6696b7d7131f930190f838e20d018bd203fa4a08bc9eb16891d0c17
MD5 cf1c8b87ba24065f870c75bf28c92e0c
SHA1 faeb6c9ae8e97d593eaad6f6a2bab069c9bcba54
SHA512 a26f9b81364a3d18c2baf990cda76f879478726d201e4fd4810a161f40fb9b87ba8ef71e5ec45b27c4af8ea914436c2e52331f370b57d198a3d7e2be7d259674
SSDEEP 192:sxR4RbyM/jK1Ml8wCB/fEsWbldrZ2xiANzoD8pWLuMULJFjHg6+WNsizlZhdwBJr:sxR4J8B/fEsWbldFNApjh5hRyb/AAO2
TLSH
T1F5720A16AA785E7B8CDBD219F651BB13D2F95063D1900F44AAFC8D1C10E6BEDA20781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7334caaedf984a21826d7b993198a6986a484bc76fd0d021bb0166c77f1269e8
MD5 e450ccd2a050170f8912445d4f8d6c8d
SHA1 417d7789fb3999f394450df5000415aa0f8e049e
SHA512 6d589f0874ccc0dde0c408d4550ce4f33a246fee2dbd26f5a34ed928ab9522a719732895d6603b3e7d6670d3776a36075de5e43e92412ccfd9d1ebe575de68c0
SSDEEP 768:Utii637pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1pN0droYxn:Utii6xE7ANWgv7fgJu1jaCf0WMn
TLSH
T19EE20C7B640CCB7E4F804A9DEC29BD9B6DD801CB5AD8CD9447EA880C03C67EF551A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0d7c4088d381bac95c927d2d8b67680b4e70af95fcd8d96cd38b58b641f82958
MD5 5de1b206a020d5386a0881cd9f9a0c8c
SHA1 0978a490a225fbf15bb06cc4dce853dd5196ab25
SHA512 237b5128ecce8ad36a7fc32b3e40c5f924da24d556d60a8426acd64c9fa0776f4b899962bb88a95d9e65cc50ba71f4cc3e5510a1d667d435e977017d96165a73
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkMN4cWaO8Wqnngk8K4pgu8cscHGshHOjyuIQt:Cm7KmgIIJ4tWGm7g09OGlkMN4cWaOjq1
TLSH
T117914501317E0251387EBA1881B99C1F86C674673139F5AB7FA819A21F26E03BDFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea05feccbabaf9a1a1f69cdbe9adc2ad0d8ce077905a62db045c050b729edfcb
MD5 71675b8fd2a2f9538cd6fb952b110e5d
SHA1 091950e0409f0ad79dcfbf7fca942f9ea4ccd626
SHA512 ba180aa9c4e86436afdd3b783baffd1ea92afce7b81b490d58b5aeb4272a0fb595fd9c85741cf51ee4a1dbfb9e3632ecc78ee88d261a48433303f036b596eb98
SSDEEP 768:xGrv+4UNbdS3jhUlYyBq7Hucys6BRvi82oP4/z6himo+02bwn+h:xGbsbw3jA3imOz6Imoj0w+
TLSH
T1CA03BF35E4189D73ECEB8288B14A7A937FF4522345C91AC0D6DE6F0E528B95E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 291ca1eec0191379508b9aa0bc86585b456346c6b0c8d007e7a2e2a08aa7c286
MD5 c96108d92ad44d81f908345e433bfe40
SHA1 3de8e4ecc05b71ccc7e9a9827e41dd80432090e2
SHA512 edd10c161390ddb048d982b1699a16c70350d79801430dbd67f706f6b292428530ef763d3973b8ded44e14d62b7937e502dc04f9133349d4dcc6cc7a29e60f1d
SSDEEP 768:HN3KW8lYyBgyT7Hucys6BRvi82oP4/z6himo6k2X3r0:HN3Ga3imOz6Imovg3I
TLSH
T1B1F2BF70EC559DB6DCEBD289F54B3B926EE4623344C86E84E9D99B0D1187E5E030F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d7a852a450a6fed99a80d0c869fb958cd3e0ddfaeb1142657443b25c6240bcbb
MD5 67e246e36e1cabed6d7118e4d0ece232
SHA1 8c0a5bed91d39f780ae2daf7b22ad3853449d1e0
SHA512 8b89f35cbc0f24a906763de0bd0c6444a6d623cda187a44a224a4bb3676f1928eb32a9f59bb2f8b02ae5637b510f07f645b9c84bdf45b8db72b02a3833db1871
SSDEEP 768:Jrv+4UNbdS3vWilYyBgyk7Hucys6BRvi82oP4/z6himo6k2bwn+a:Jbsbw3TR3imOz6Imov0wJ
TLSH
T1F903BF35E4189D73ECEBC288B14A7A937FF4626344C91A80E5DA9F0D5187A5F231F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 14ed49b483c7e88fe14b88093af61d5645733cc9093133952d181cc6eab91e89
MD5 41e533f535430b849fb15381d3dc9b5d
SHA1 a051a752020490209438c963ba776c2a2e519ca8
SHA512 50810d47d827c6f35dc34790b5b65b483ba675eec6dec6eb92cc80f29fd3b5d59bc9070f5dd27000f5b9e732abaa98727a3ecffd2ccc026e544902c997e8ba12
SSDEEP 768:Fa39WClYyBgyb7Hucys6BRvi82oP4/z6himo6k2X3r0:Fa39S3imOz6Imovg3I
TLSH
T10BF2BF70EC559DB6DCEBD285B54B3B927EE4623344C86E84E9D99B0D1187E5E030F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c36f7c890d9b46ddb6f0a2b7c44edc3570f075780a88cfa604f7121e4e3895d0
MD5 ac66bab2922c304c908be728769381d0
SHA1 8ac47a650a158efd10b3e52faa539b044321e048
SHA512 37547048c21586e5919ff729d408213b03544e874eadcfa805e3cdcf6043e226cc6156fe786c542b7c33afffafe1f251a39a1afd25dc3ba12dad75dafe9dec9e
SSDEEP 768:Rrv+4UNbdO3jWWlYyBgyT7Hucys6BRvi82oP4/z6himo6kNU:RbsbE3ra3imOz6ImovNU
TLSH
T19D03BE31F8589D73DDEBC284F14B7A937FA4222344C81E94E5DA9B0D1287A9E131F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4d170ae3edab9a678ab546e5a433f37617102508e3b27137d1016a7036fc0f2e
MD5 7efbd8e91e7ba6ed7aaed0686e0c0121
SHA1 a1eb979462108de2b2d921e88fd8a8d5a21aea12
SHA512 fac0a4604abe6d8428e99e06f70481c94489ee2696fa4365831cbdd38b2bcd66935bbf36c6e60f346436603c85a4e407ea08a6dd4cf80362f2cebdcfd5763436
SSDEEP 768:Ha3jWUlYyBgyb7Hucys6BRvi82oP4/z6himo6k2X3r0:Ha3JS3imOz6Imovg3I
TLSH
T1CDF2BF70EC559DB6DCEBD289B54B3B927EE4623344C86E84E9D99B0D1187E5E030F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d938b696-89f9-47ee-a34c-b69807aeb002.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d938b696-89f9-47ee-a34c-b69807aeb002.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5922e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5922e0.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9e413a84-e1d7-4c65-9e75-8a43796ee186.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e413a84-e1d7-4c65-9e75-8a43796ee186.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\base_library.zip
Size 711KB
SHA256 57e10afadcd7b332d93848afa96e059fdc40ab1053a5cfabed13d3e16ae1a977
MD5 9754aa61d43512e1d509cf27c451f8c6
SHA1 0a60bf1e7dc070649290f0cb0202495a5edae411
SHA512 4317fa5c28777e788b35edffcc26b50f35ee23a3f68ca184764897eb205df0b3d4a13369956673d92465f0aa8d846d614f79fc7c397608b8a7dd3c4c02996b86
SSDEEP 12288:ASoQDSKSfyEcNhyWaxb2osQNRs54PK4I16dSk1mPV0c/Q:toQDSTfyEchsb2osQNRs54PK4I16dSrq
TLSH
T1CFF4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45922\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir472_1131381126\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir472_535197563\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

x7dokzgz.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j3lde7q2\x7dokzgz.exe
Size 5.4MB
SHA256 f7ecd5f8b014cb0ca8890ba366bc3a7759ceb650b336d4b04cab147be1b465ce
MD5 01bc145fc5c06494b1f0bf1e8ebc9013
SHA1 ce8623254f7916da8ed74bbc5e01f6cca9f81f84
SHA512 e173537afbb6d28d738fb40563775dcb2b4d9a8565085e3cb81d6451246408329cec247de18d3bbd836f2685e772a53066e991f62c6946c3826ea2afc9db72d2
SSDEEP 98304:6CgtvzICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllXHhM3wh6zrY:k7ICteErownP0oTcMsABqlkgczc
TLSH
T1DE463308B3A809D6E6B3D53D81565211D872B4264BB0D2CF43AC9B662F777D0AE3FB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads