914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c

Analysis

max time kernel
1s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/09/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
Size 5.4MB
Sample260901-aaa7kstsbs
SHA256 914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c
MD5 7768f21b61f37da7915076adcdd83791
SHA1 c11f5f35c8b62f17c6fd52b647ca2b839fa3d91b
SHA512 c80821d27d37180978d70bf763da1a023e8bc1c15e5ade406946113c8e1d1f02f2c99f8c44eeb4183028b901aa838a32183b9b6b6bc289a0ed58e49aa458b3f8
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUV:E+ICteErownP0oTcMsABqlUutv0
TLSH
T10A463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Extracted

Credentials

Protocol
ftp
Host
138.201.132.148
Port
21
Username
anonymous
Password
[email protected]

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q8yped.exe	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q8yped.exe	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe

Loads dropped DLL 11 IoCs

pid	Process
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148
Destination IP	138.201.132.148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\ecw209x9\\uqdm8duu.exe"	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 TTPs 64 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
222	ifconfig.me
296	ifconfig.me
332	ifconfig.me
400	ifconfig.me
401	ifconfig.me
2668	ifconfig.me
4145	ifconfig.me
4584	ifconfig.me
4600	ifconfig.me
257	ifconfig.me
325	ifconfig.me
902	ifconfig.me
1450	ifconfig.me
1825	ifconfig.me
2127	ifconfig.me
2547	ifconfig.me
192	ifconfig.me
194	ifconfig.me
537	ifconfig.me
4036	ifconfig.me
4229	ifconfig.me
230	ifconfig.me
1308	ifconfig.me
2787	ifconfig.me
2947	ifconfig.me
3035	ifconfig.me
4591	ifconfig.me
44	ifconfig.me
1260	ifconfig.me
3164	ifconfig.me
4012	ifconfig.me
4583	ifconfig.me
4753	ifconfig.me
176	ifconfig.me
2365	ifconfig.me
3056	ifconfig.me
3077	ifconfig.me
3239	ifconfig.me
3548	ifconfig.me
4046	ifconfig.me
4686	ifconfig.me
786	ifconfig.me
883	ifconfig.me
1297	ifconfig.me
2228	ifconfig.me
2945	ifconfig.me
4261	ifconfig.me
4688	ifconfig.me
4907	ifconfig.me
843	ifconfig.me
1461	ifconfig.me
3063	ifconfig.me
3660	ifconfig.me
231	ifconfig.me
828	ifconfig.me
2403	ifconfig.me
4157	ifconfig.me
798	ifconfig.me
1528	ifconfig.me
4021	ifconfig.me
4601	ifconfig.me
4795	ifconfig.me
719	ifconfig.me
2526	ifconfig.me

Hide Artifacts: Hidden Files and Directories 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
7536	cmd.exe
7684	cmd.exe
8600	cmd.exe
5088	cmd.exe
3984	cmd.exe
7084	cmd.exe
9248	cmd.exe
1220	cmd.exe
5672	cmd.exe
6600	cmd.exe
7140	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	msedge.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	msedge.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 4812	1132	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe	87
PID 4812 wrote to memory of 5088	4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe	88
PID 5088 wrote to memory of 3736	5088	cmd.exe	90
PID 4812 wrote to memory of 3800	4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe	91
PID 4812 wrote to memory of 3068	4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe	92
PID 3068 wrote to memory of 60	3068	msedge.exe	93
PID 4812 wrote to memory of 1304	4812	914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe	94
PID 3068 wrote to memory of 4884	3068	msedge.exe	96
PID 3068 wrote to memory of 692	3068	msedge.exe	97
PID 3068 wrote to memory of 692	3068	msedge.exe	97
PID 3068 wrote to memory of 692	3068	msedge.exe	97

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2976	attrib.exe
5388	attrib.exe
6328	attrib.exe
6332	attrib.exe
7956	attrib.exe
7256	attrib.exe
8884	attrib.exe
9620	attrib.exe
3736	attrib.exe
4148	attrib.exe
7124	attrib.exe

C:\Users\Admin\AppData\Local\Temp\914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
"C:\Users\Admin\AppData\Local\Temp\914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe
  "C:\Users\Admin\AppData\Local\Temp\914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c.exe"
  2⤵
  - Creates a file in the Startup directory
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe"
      4⤵
      Views/modifies file attributes
      PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ff86d95c188,0x7ff86d95c194,0x7ff86d95c1a0
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15227077546121405458,8222950451017882209,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      System Time Discovery
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15007693136748733484,18357733066726845146,262144 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,16785243192036161198,3301750779926792580,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2451000415285065816,2514762866125940061,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6455931841715263859,12625746903310643272,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,2217390985190435967,553014738462967118,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,10367186119684658589,12169179577885879621,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4568,i,6639858386593246642,5358169237917988305,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4868,i,10946317475990577778,3784916248622969601,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5024,i,3923955977941003799,8650981287197728182,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5560,i,4831527371981524431,12718873927206643259,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,11253005576803686987,12284458465592845100,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5912,i,4050065555958566823,9594337313233905494,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6096,i,5977507937831615021,12243895908481180450,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6264,i,9245873776515861020,15960438221101764900,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6612140476085385096,13723454534376215771,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,8094828955142957675,3476542723771681250,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6576,i,279553331852841478,8437312381746723817,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6744,i,5919935250290381754,5529573926505240851,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
      4⤵
      PID:376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6924,i,9440082583873420727,12594188154195869670,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6720,i,9840397285238934652,6778902011095947283,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7208,i,4318610427945423119,16369384865933085363,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7360,i,4803541374991258802,16893579977235587981,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7536,i,6874186494321292590,14008396557309519422,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6744,i,5319082689067187957,12112186258170135235,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7664,i,8829134343827404568,8941822472858133259,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8356,i,3817176840375555265,4097972001528017378,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:1
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7576,i,2835001785306619721,16795180596581473873,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8656,i,9522775411084695166,15919935443061899947,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8648 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8792,i,8805711788275980803,1325787454916099446,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8988,i,16003320555394114332,8258806558445963899,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8812,i,12884584653001358662,1815361722216876767,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8364,i,8232135097183493784,13447195234097176047,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:1
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5248,i,2459642908302308048,3427510873932378086,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=9344,i,3173037222090833298,1032782052258839868,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9636,i,6033154756523684386,6261730280402871312,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:8
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9636,i,6033154756523684386,6261730280402871312,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9644 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=9796,i,2288169096523743262,15784173114421992787,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=9948,i,2017428121529631082,18319440343964364458,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=8796 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=10048,i,4046937250860096361,4015910606491109941,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10104 /prefetch:1
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=10248,i,2329381029121941735,631208825434537046,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10264 /prefetch:1
      4⤵
      PID:6364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=10404,i,8603585251563804255,1920530708252047668,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10432 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8396,i,965039306969919198,15749283448060681491,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10616 /prefetch:1
      4⤵
      PID:6728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10772,i,2264853422469923523,9562451569950385552,524288 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10272 /prefetch:8
      4⤵
      PID:9488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=10732,i,329079041704656755,15109124809577876814,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10344 /prefetch:1
      4⤵
      PID:9496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=10800,i,12884173296006639069,14333644740448300142,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10312 /prefetch:1
      4⤵
      PID:9504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=10812,i,13201178241776072167,3081816450776839220,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10296 /prefetch:1
      4⤵
      PID:9512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=10900,i,11392610151267060895,10416964076327337302,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10328 /prefetch:1
      4⤵
      PID:9520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=10924,i,2314521822274807137,5102720943898477196,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=10604 /prefetch:1
      4⤵
      PID:9528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=10948,i,4505894886353386224,14290564424963775869,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=13256 /prefetch:1
      4⤵
      PID:9536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=10980,i,12575086289480030391,14984654046308135061,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=13264 /prefetch:1
      4⤵
      PID:9544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=11024,i,6264636661797549269,3245470097009462273,2097152 --field-trial-handle=2252,i,16137680980536521873,11663500945321681337,262144 --variations-seed-version --mojo-platform-channel-handle=13284 /prefetch:1
      4⤵
      PID:9552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1964

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe
1⤵
PID:1144
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe
  2⤵
  PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:3984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe"
      4⤵
      Views/modifies file attributes
      PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5156

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe
1⤵
PID:4628
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6fidx2j\tvuetttv.exe
  2⤵
  PID:4252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:1220
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe"
      4⤵
      Views/modifies file attributes
      PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:5640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:5160

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe
1⤵
PID:5268
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cmsva320\m8r6o6pd.exe
  2⤵
  PID:5488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5672
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe"
      4⤵
      Views/modifies file attributes
      PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6396

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe
1⤵
PID:6168
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il7sdp4j\ajqbr3t3.exe
  2⤵
  PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6600
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe"
      4⤵
      Views/modifies file attributes
      PID:7124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6280

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe
1⤵
PID:6468
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hnfjr9sr\lszseooh.exe
  2⤵
  PID:7064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7084
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe"
      4⤵
      Views/modifies file attributes
      PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:6868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6336

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe
1⤵
PID:5412
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vo63vu9g\m4c30euy.exe
  2⤵
  PID:6744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7140
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe"
      4⤵
      Views/modifies file attributes
      PID:6332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8040

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe
1⤵
PID:7348
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xcehdq6p\frx873a6.exe
  2⤵
  PID:7448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7536
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe"
      4⤵
      Views/modifies file attributes
      PID:7956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:8180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:7436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:7660

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe
1⤵
PID:8000
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bb8ia9wi\6aq5kbc4.exe
  2⤵
  PID:7740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7684
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe"
      4⤵
      Views/modifies file attributes
      PID:7256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:7380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:7640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:8356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:8668

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe
1⤵
PID:8428
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9pwi3wvu\37juclh4.exe
  2⤵
  PID:8540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:8600
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe"
      4⤵
      Views/modifies file attributes
      PID:8884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/s/gononstopukraine
    3⤵
    PID:9016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.tiktok.com/@gononstopukraine
    3⤵
    PID:9064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-ns.org.ua/
    3⤵
    PID:9160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/gononstopukraine
    3⤵
    PID:9208

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe
1⤵
PID:8480
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cr4x787h\kiihekyb.exe
  2⤵
  PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6mduwrh\9vpkhzci.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:9248
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n6mduwrh\9vpkhzci.exe"
      4⤵
      Views/modifies file attributes
      PID:9620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41423998-f0fe-4754-a334-97b6b62974f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\41423998-f0fe-4754-a334-97b6b62974f0.tmp
Size 12KB
SHA256 c299bedf32b795267f89dd76e9af0eaf18393aed581d8c20670dcfa45f31664b
MD5 9403f81cda8db00ff742161aeb25e7cc
SHA1 7a363d397920abd6d021be61e52b60b1c803db6d
SHA512 f17cc18681449ca767340698fcc7b7d25a98a659aa8683ff4d1afcd9c74698f703dc9ed0d3b40b799f43fed5d4cdc6306052982a66b6d9c0fe7054fff99fec5d
SSDEEP 192:uuS+sNEFQ1MmBb/NQmiU1hXL70aGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nFsNEFMMIbjDb4CsmF+23tUNWZZ
TLSH
T1C6422A716C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eb2d863-23bb-4f27-8e8b-d3247e82396e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9eb2d863-23bb-4f27-8e8b-d3247e82396e.tmp
Size 12KB
SHA256 f4e47620c155eff262d5b2ec6a920a7b4010dd9807d80b384ab5d0ef1acb90b4
MD5 31e326ca26b3b47d9b1904469cca5365
SHA1 9d0947079a7460041a20be94898e4bc7825ee5c0
SHA512 3047077cdd741b79bb5cb400f6933384dd5416d511ceb5a444de72ea1c0594748e245d693ca5387971373616d259a7e8ae8032357be15cbf7e7d40a0e9a69ea1
SSDEEP 192:uuSKsNEFQ1MmBb/lQmiU1h/LP0aGBPKpcCsmdb+23AC2dNNsqqpuXEZ:n9sNEFMMIbLDD8CsmF+23tUNWZZ
TLSH
T15D423A706C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 17KB
SHA256 ae2195ac96b260eac6e79ad8f0065fcd1c0f972831c6b6056b513c658d53dde3
MD5 099367d5e4b37301d4cf62b9a486be65
SHA1 60ad34a9b94162379f5573684bb626f5fef07f89
SHA512 8d8ceec8ba70f30380a3ce89f26f92ee0b1538d665d64edeae25965a9e098f4bd7db895d228accd31f2e7dcd80cfdb2b943f9e89d4fc168478bb1d8322024caf
SSDEEP 384:8aK6SZPx9KN47OUAcDLijw0JHiFOnMBzC/koLL3WYMc/Q9gX3reUSZ:DK6SZxgNtXTlVOzC8a3bbVnr0Z
TLSH
T1F982D140246227B4235162182762067F1FBCED3B9A3557636C33D96391501E7B9C2E6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 26KB
SHA256 31742bd64f46a7ede3d061cb6387891aa01c42077834d64a8aa82021c19e16a3
MD5 c9413d7f9bec33bc9c7a6d1f6609e444
SHA1 9a6b9624b230c44de590882d3ceb1f9e6831e6a9
SHA512 d79e719e7b6d5f5b4f2be6926459c4afbec7c01027e52f55ec9a720049dd44a8b88b1193b830833041cb14d6ca631fa991c7d3a97444234438d49346e3128c07
SSDEEP 768:t2ERwltKPbvATfxeyCxJgx2qDAesh5D/Wr5Ie1gSEF2hG:BIQzYbsux2qDnUp/OgkhG
TLSH
T186C2D0DB11D2E01120F2E59398BF9DE32B9D1AE29B85169335BB14F171EF520DEC02A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 58KB
SHA256 f4e5930221564cccc6fbc5a5ef422242ebd3fd8bdbb28c3f6b2620f6f18bf177
MD5 01f515179a66dc84d15b91bce24b2f88
SHA1 38db7ae9160582c1287b11656777d1eebdb6ebdf
SHA512 25c4b2b0f086bc41fa588e0eabe6597cae775cf174ee0c7c019912575ba17345c7e6114ffe8dce5ced0702e75e6b1932ffa4140d88bd2dcd013a1859a4724f6b
SSDEEP 1536:YB1xbMo6qAC72/pX9oqB4tIBEWxIFespvmuffOSK:YBXL2J9oDIikslmuHK
TLSH
T18B4302D3A0081B90DC0217568DCC0ED68FCFED924915BABF9A5B48A8F01ED6D56E21F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 75KB
SHA256 42476d62af3b4413b94286bbfe115916d356c0f5ac83f8402ab1636d51481572
MD5 b6dc8a30957bee1ba22642d38cfc03a8
SHA1 a8690459f947bf5609964cb3e965616c82cb6bb3
SHA512 4a12bb1edd279dcb409f620a31b20e4a122dfa6e9f8b673c656a4c6f0d479abb0038062bfcd13ac5173d3596db17e5b6d7c5ec07dfaf01628a1d1fd6dbb5bb94
SSDEEP 1536:aeR0PvNKsu0VhZkm08HYSR2CwYHg8tGpo7j4xdD3tKUMad5Cio/B:a00PvNKsu0V/km0cN8CwoZGpiCdJKUDG
TLSH
T18E7302171FA847860E70057625E0204CF324EB93A95C6DA4D82335F59DE4F52AFDABF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 75KB
SHA256 3b4b2fc56d46b5c95f4d2a790b21221bf4d3cc3e6c14ce66a2e2c249da27ff26
MD5 84c6c466a288b666c9e37601b684e27b
SHA1 5671728eddc4cbbe6e6847e0910a7b1fa08e3d93
SHA512 e8d093ed618e1a909794d9c3c117accf2bde6729607a677c0744dad6a0a8a35b8e60cd45bbbc5fdf8b6e07882f30908364113637b9de105a276b29142f693ca1
SSDEEP 1536:CrNnWXhhcu0kiKWMGWHO/B3VOPE5tZpUF3zNJ5MHHwbYoXLjSh9cEPI4nB:CrNWxh70LKWJBFJZpszNJ+mHj29DnB
TLSH
T1707302DBB407EF1FECFD5BD64A2A0D838B1F5B222681444B30BD49F6E379E942448295
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 219KB
SHA256 09985516bfc2ce684db3b3d5720f5758c7f6eff437c22967f8d4bd89e414713b
MD5 fd50777d7b2b42db0753d1bc7395246a
SHA1 619b0031a14d67ee82c5b449920f8f85317b9da5
SHA512 727cdf15d3e6c6b2a23dfbb1fd7ed0a59d583a5590238168c08279882e7e77425e8ae4446dd75f49a02fe01d2835bbc937a487837ddf3c1496109589d20d3f3a
SSDEEP 3072:z4TRB1ri8V1Cr/BS8Psu58+1+0kB/oXK4M8WqNP1wbU3qXYzGOn5BFcsQgJ3BoVp:zoRBZFCrEMrSk7KiZ1w4aXqHAgJxofv
TLSH
T13D2423C7E10ED95B8FE83575226A109EAD604B661D3338C76AA5C073DFC4D5E137B881
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 77KB
SHA256 41acd2efd8e29c20f6b844089809f8cbbcc954d8f693e28ef7b40e2f3826036b
MD5 7d509e7fa7d4be9fbc2ec1a04f7a3d56
SHA1 8bc9948200f3444acc7a9cffc7371d90339616ac
SHA512 125b640c02c82b5a7ff8d1c72e77e898a0249411c5cad5681d88cb148f156b296bcfa54bc884f741e4bf097fe849c1ecac46d50d12844509857e5f4a181429de
SSDEEP 1536:whvZpzCjpXBUK1iTSb9LYhoGV6IKXRWvv7aWOyShODpaYiZZQyQ:gzOpXB0colKhWnbPShAMayQ
TLSH
T18E73024D3514C312FEF89C89635344CAD50AC2DD5E9DBE2A2025A087D2FBEEA9DC0E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 108KB
SHA256 864e2c14b4fcfe85ddff9eb9738219dddb32ac6d43b9697e6b162b099c1a4a9a
MD5 925512687002004d5bea4108fad44377
SHA1 1599aa9e8cbe2df17464ab50244ef30f460dc0a6
SHA512 19cbdec7a8a03561e0f2f83daed2b5a6abc833f562f24fb0d335f4d96ab9ef5be7bed76b3de914e88ccabd0533d44f0e8fd829b37a74803246aef760f77fea88
SSDEEP 3072:DPJ3gihkNMYzNrqRU3PsKG0Z+7Tl1MOZPF0:FgN2YxzPsKG0ZaB6W0
TLSH
T1D3B312E8F53A0D5E662299595BF398338EC6E557E233E3D534422EE1253A53CD2F8120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 282KB
SHA256 f1f3aad0d70b54a0a07e59a9e6423dad2454ef3adda92e6666022f09cd6b9a9e
MD5 1693aecd67ff6cab1a699719ecdc0e65
SHA1 2a565b651eaea317b4fef5430b2af9aee5134361
SHA512 e1f171bdf653ca17d942378ac03c2acff97a60eb4cd2e257d01c6d2aeb06ca6022cb5e684c671f4e6c965fb4b4932c321d862c77768f2eeac98ccd842c57fc47
SSDEEP 6144:cjqJ0baJvXYMZxHIzxELo4xpIWPkXkWT3ywd6FvImbBm:cGJ0w9xUxE0SPkXkWvyfBm
TLSH
T1EF54231A53271AEE9D3D7313C13279A606EAC53EAB04F1C4178EA9D12F1D9D1EB34138
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 435KB
SHA256 ce2134811edb27567311333fbc66bc26d5827ed131a143c8b213b6e1b114b439
MD5 87a7bad84ea1b0af022e030c2280779c
SHA1 3732164c770b7f1ae2bb735934f1c3d0cabe3024
SHA512 654227737f4bb6ec694d07320b4a7a522a24ecabc00b7d3627a8ca38969163393b5dc5e8c34841ee9e89826d00d2d7b2d873a4bfc450e20800e191124f7ecb1f
SSDEEP 12288:1y5TnbeBz6whZVBRa6DZOcZQTF5/KQA5atUFcs:1y5G6wrVvYEQTF5/hAZFcs
TLSH
T1049423B393522D48E9C1327F957A4166F07CAB0AC88A559DDFEB97F22C13353B08E152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 37KB
SHA256 6e5cb713bd8e426c8c4bcbaeb68f921842c968eb78a569f8e13e301ce714c1a8
MD5 95d8e2c6f815501936ab45e4ce733f8f
SHA1 e1cfd1bdd30e7765d9781a72be2e9920ceb9405c
SHA512 03d82fa7d5294c93052bb2cf13d044ac66a729ca669da3c8fbbe9ae06aa54243f3ef588060793ea8d64b9a5ef39ac3117b2e30a4daa9ab566cd7cd636ff4116c
SSDEEP 768:naaeCsPsgjJIl2s83klYHNmySEC1FzR901HoptNK9uljFv+jCIevJgKu:n7msgGD83mYYRWIptNKsjFv+jCIevJzu
TLSH
T15D03F15E7254F018964B0532C41F8B8D5528FE84BBDE043E2C4972E6ED96DFD8A86C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 100KB
SHA256 a165e5ef1939c256b2ca8f2cdd5b3d2ffee5f25f9a4d81ad8529cd6ae219942b
MD5 b332202de15e3ef140ec56c4323123dc
SHA1 a540aa405d3368628179b903309168a3c767d187
SHA512 a4bfadb5a2e728c3ae08f2ac161d18aeb612a02bd1d682968af7204e8bc62a480fce7f61e00bd361eefaa7d149ce181f4a9ddb3e2e738b3db0a3c86fa2868187
SSDEEP 3072:PB2dojqhL7dTSCve1KV5o770t/NmY3HbF+UmjBi:cd4G4ce1uaS/ItPli
TLSH
T1FCA312448884CF1CEBE0D3809F1610A43D3E61B46ED36A9E16277ACFF0466D69BA43D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 20KB
SHA256 9e49ccce895d0982ffb0c2b6aa398bd9440d777abf144fc22bdfa9bff3a25f40
MD5 321744f5becc2609d11b7edbcadf352f
SHA1 d0d76b4ff6fb63b4b5556596cdda0e51f3b8efc6
SHA512 30d7ab8c2323972f1b70ba4c56d0280205e24937220a5a05687a183d54b015a0ef25ffedf5ae59076d0bd7f0e88ae561fad3eb50046842d31e6274dedf67e5b8
SSDEEP 384:AaOmH6Erde3AT39qM9khYkQ6OuS7Pf9qXRYe/5XEWkSRTs9swEJy6A45m:ZOJz3AT9FkekQxuWfsXis5XrIs9Jzo
TLSH
T107A2E13A3B60AC771259EC8BD810BA58559D070138B6DE3D0FBADD5F32F1417EA0A239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 37KB
SHA256 c9093d1ce4c714d679817fad24bd15c78492e466965129056a74a656c081d17f
MD5 3c4830249a62bf3fe080174bb652b8ec
SHA1 d8a994242fc3d4e185ad3e0955d405fc35953b5f
SHA512 ed4cead3f531a61443b682cbc301f05c94e3803b31e614491f01982a1932694d30f867471b6e4caa47393b4a494b3fc59fd9ad27a35df80bb67990f430510cbe
SSDEEP 768:Vs6/ylcuG2zZH7UI7ALc52y4WOp93K7Joq66jrSSta250oY46:hgjbUdc5DPOp9a7JoifHtvxYp
TLSH
T1A8030123ED49EEC6F723DE01B5A6FA2A8FC5F51256450BFA3218B2B2014C3850CD7975
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 31KB
SHA256 f71e6ccaa61fab74b35a4b54a7717c4d0932c05d6620855cd21a3ab556e344e4
MD5 f4419077c29af5677b32c0e6bcbdc234
SHA1 fe4db890d6b33164115c53eefcb842ac151c6bbd
SHA512 510566c7eaa350fcc4e0c67cb73be8323cf52734bd600572d3682bd1bca159ffb5e584afd55caea29d305f9b3c6b61ad58ec381c455b14625e426011a0547b51
SSDEEP 768:OjR2Q+l3VzMDRfn01hn3iIYBF0ATduy9I:O4Q+cDRf0HMF0ATdfI
TLSH
T164E2E1CF878BFE4FDA6A535F027FC2495835C781924216DF3C259898705CE41B86239B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 27KB
SHA256 01bac84a9c539f9b969da1c6f82f5189e96e9ac15e141310bc78a0b61393cc9e
MD5 1ef064f11ffb10d9c2c5bc8416008ab8
SHA1 c363cfa91dfac160a9aea18dc80df01a87ad1f06
SHA512 76562c1074510cf069683a5bc6fc29d0181e31fad5b726a84326e5a4e2a89c9958e9dbb04db4d2416401cfe3f6e1a7ce1962b8181be21060f25e32f2115872fd
SSDEEP 768:keG4P1If+RZt+M9dfUMgOCYhkNoZgmk6Oa/Po5fAlQ:auNMM0MjRkeXBPcEQ
TLSH
T104D2F171362206AA4A83A74C6C9A058711C6AFD7D9C37772E1628F700F2C5F327638B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 69KB
SHA256 4ff7209de81681d6d7e38aebc78653798b3d808ef0e32cdd021bb69513dfba2d
MD5 7daece975e1859e0ed59170906b8da36
SHA1 25b9a34a7da22ec84e566ce3b78bce2d04b16978
SHA512 82f5085b3f6d21cbccbf31aa98842e9e29a5a77b0701f049ff937ab739275447290cec59f6c8f041027fc77c1a303e87ae2097b2efbcd056c3aee453dfadd6d3
SSDEEP 1536:/tD95yacit2VPPZDukTLaswd/CNkXyYh0JcQKeqaD5ZrvQspi3jU:/t95yacY2Zwk3twd6UGpDfpR
TLSH
T19663129ACC0DDDC01FAF2DBFBC9FD4749DEE295217847C8B605651260309A212EC2B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b2
Size 49KB
SHA256 fb114124cbfb4b52a0f42ba5387d3fc21083d378b8c147f0d8513478e51206d4
MD5 e1cc11da3b27dd79369e88302e2f5d46
SHA1 7efce266ca463a03226bb2feec82530147013c9d
SHA512 c30aa0d611323cb9127b9a48a8e8774513c2d474509adba61f4ea1d409523dfbf3b7cfc8e1c39e7ccd71db87e13b3796ee64e4cfd96d62591317047533f52880
SSDEEP 768:o+DfLblC7k3UQ4ERyv52atwPZoOKim2yuWrKOBA/AxBQOAZExDoiWiyDPQN3xv+s:55Kk3UELoOKH+YNlAaxD7wY8fIof8yB8
TLSH
T15133011A63D110D2F6EE8BB262651347CE0828D9FC5FD0493A572EB5C8335C273B49AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b3
Size 36KB
SHA256 4018de391c54699ca3450cfe46f6a061a98886e5dd8c332dc8b744804bf14310
MD5 aa2400b50e83c5b3d1ee61214d7b9f76
SHA1 e65c1f71d4641f072d3c05229fdad014218ab580
SHA512 bb26d7f7670c2e4b0fdf977ef15c1d28ffea3ce2f3721eeefd88706cc8470103bac1f91f76c6a9e4968dc14a07efaa176bcd79e34c8ac93fad8ef109862dcc93
SSDEEP 768:FOl2CIaE4ln8Xy11Qz2KHvvjF/6ziGMGF5/pGVuXKQc7Q5t8:FOl2p/4ln8XyDQztHno5Ag56
TLSH
T119F20206E4F6AEEC563B8D6F521F82D21005EA149BD322096ACF4FCF0B536B85A3D035
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 32KB
SHA256 37d636331f30cc5e3fea1ca983b7b86bc0edd15afcd9df770cfabb776d222bc6
MD5 bebb1a7c9f277a96fd91d63deb5dc556
SHA1 301296d54a5606fd2f68c81d42bf262e2ebe55e6
SHA512 ea092b70384b25ac6833140a0435dbb8201e9eca923eca40a6bb9d4da9a2a5a635ddff6a8bfe8eac84f6a145a79fba48bcb22193e34dee38ab5e23e4144ab7f2
SSDEEP 768:fCQpNnwUctPxEVRI+7Up9V/3XBmlkdoc3h95O:fRNnePORI+oB/3xkejA
TLSH
T124E2F11C7DD320B55346EDA56C273B2DEF855B502E6B97314904A832184EEA31FE9D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 103KB
SHA256 fe9bea26a020af86937e02e18c978c58c800ebd7912e1bd5af19a431bea76044
MD5 31b3c33cdf8d448176fafc46b5d0ce0e
SHA1 2f5c46d13361068b6f0e08f1ce3994eed6b0e24a
SHA512 6a30a3d91e88c0080dd261d4849d3b50d88f7b1daf56d9865d8598069e70132e92f249ea2873941a6eaab0174ddb3588984a66ce1e22cae369e68b1a4e14a9ec
SSDEEP 1536:cK0yw0oGP3btg7zojyk6EAt76pwJ/ouCn+IuMNMTLcTcBc8J4KnwzEzl40BxX0Qu:cK09Gqw2kyI8/oufhtGYwEBxbICiHD
TLSH
T12EA312CDFFC83CAB5DDCCEA09E1FF93DBE43DF959118888A759619268C442B05A84487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6
Size 51KB
SHA256 aee5514386816d831334632ef4e1f8043b26f005ef1d099f8ef1e30498814a58
MD5 d86d2ca0cb13bb90f5b5fc30497dbddd
SHA1 60a3c61cdcb4d587c115471cb9bef47935682d39
SHA512 d74f1307076d23f6ab8d141802a56eab0fc3d4f8f34db31725aabd38888ba0358310fda637d3d5d051c546843698caa5e02629d5c4c5f7f72ef82006a3ff1bcd
SSDEEP 1536:ZMRBDwlOsZbkuNp/moM7slD9oqlIhB8Zcd/+:O3wlpvNpf6slDlILd2
TLSH
T17633024DFC36120E0F307CDEA5645152D51B903FA79F28FB8AAB8164D68C38D646873D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 84KB
SHA256 ae528267ccd1bdf21fff82f757a19613d25b15d3b85b6f9e06260de4968b1560
MD5 06addffefbad89e25347c79e1a58461f
SHA1 57a2418001d6596d335ddb436afd892d91f9fa8a
SHA512 6a1109f764894cbae227a29bb2e1946e5d3af377112d54c3051916dd698d93c9d574b4bf0116220a6c3979dcae1dcaffb132e791e0bbc7c0ed4b36a856e143cf
SSDEEP 1536:ODCeMXFY/r5r7u90MViFb2IqUwupS5j6g47wNrncnkuNdqO25S:Tx297uviFbHqkWfxrckuNdr
TLSH
T19083123F426E0B84A975A30FE0DB631AF7FC4F37B039AC5659936048504C5AF9AC65E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
Size 25KB
SHA256 7383bc6bee3f2e4085141edbe3cdbf8ddca539cb4ca1a24da49a246fea767aa6
MD5 e949cf7157f94ba443ad73847f03fdaf
SHA1 356b6f611bcbd045d3580a60ace926d95fc630de
SHA512 1fbc559899c03b9fda132ecbce70f408d5950a63964f352acabefd73486a7e68e27030aa58b40d23d308c63536a3a6b45cc189bec1a2a5b0425cced980be63b1
SSDEEP 768:hNRdCS/uH6JTS+RGXAA7BPrxGBO3S/sjph:XfWiNA7AO3S/sjph
TLSH
T15BC2F2216DF2E204FCDE5532EDA03CB45BB546F4E22D6B3D14D24D3972EB8E05E48618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 39KB
SHA256 17ae385ba368083190659074564114a9cfee7f8aab78358cabfdaf0a5d52fb49
MD5 371c51720bfd33ef23b62a40b0e85762
SHA1 04ce08112983dd0922182a138f805f3c7a0d5d68
SHA512 0ae7a5142326c2e9f21d9511b2d59558b4c936bb0e1f2eea2ed75f95dd96d43a840f1fc79e5ad6404e80905e08c044d9afddd00a48f07025e37f8d9114fbd5e5
SSDEEP 768:yj7VwcHPCE+Pe7nPndIlGFxldhjCb1uDkZk7kTbwQ4gXLGGR:8wcHKE+YKl2vvCb1EkZckt4gbGGR
TLSH
T1BC03F1294C406C36E5CAB183B7F1FB81A937F1AFB4EB6E625D25DB405B1B01D2D4A4E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
Size 111KB
SHA256 913ebd2cede3c83b17bb45c900dad964bd73047fe821dfd7793c158e82aa3c9d
MD5 a22fd286e0f3adee04ac0df333d67bcb
SHA1 fbcb3c3b1164cbcc33f86651567aea84b1cd51b6
SHA512 ff36bbf03984a55f3aa2d8b60229e0584bad1b7abe69cdac7afd66d93459601a015c49cd38c177a02635cd228354b89bfc758bfab3f30836a2c0b890afab5b8f
SSDEEP 3072:+DvOi4xuUb3vEWYKgQYygzy+soYB/TeDtw3jFC1Sr3T:9icb8p3yuymK/ZFC8rD
TLSH
T1F7B312C59A42BD44890D6D1F9B7578CAC64A3C1F01A8AB1ABE14ACD49F4C3D8C7F31E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc
Size 19KB
SHA256 81bcfa69047e9ee3376e395d4ed4f4957897d7b01c956d3ac5a11f2515c30ab1
MD5 d0f08eb326b538b21915aba79dc1f205
SHA1 fe83a355ac26a9c5e67dc07a1ae42a025cdd65c2
SHA512 bb84b45ecdff05a57a94f71c52944957fbc11a61b53b80ca327cb36e690fc27dbd48b8d4e5154e939dd6c51c902e66f7f34f37f281c27c6694bdce6cbda4e293
SSDEEP 384:mt42QRnBoAcWNmQdu7Re7Lf71sA69vnIqdI/3ayoqYKsI:mtSnmg+0/fJPaOx
TLSH
T1EB92D07C452A44E71A9D9EA0F6B63846CDA5582F2BB8F1E0C8574E02B07D8C5D93DD33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73cb7fc6a29ffee0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73cb7fc6a29ffee0_0
Size 1.0MB
SHA256 162c36c65efdd5096b3ed19e7f643d06caef6a8b5996dd50b6568ff1781ccf84
MD5 aaa786705f9025de0fecbd71f100b8ca
SHA1 de97a908be5e06feabdb344ebe03f024e239ad7f
SHA512 a40bb00acccd993cec8a87b4cc5a2caab4a3759d635e1b7e99bb384a6817e4e4855763ba97371605778d5599d43a6277488e4560d1faecadb017c5489aaffdfa
SSDEEP 12288:N+atFfXri1odDiz730EPQNuRdglvsc2vEVr5+qLYzIglf:N+27Eo1e730EPQNkdwkJE3LQ
TLSH
T13135181517609926CE7A13F541A38A17A33581083FC3E727A1E5B7353C683F26F9AC9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ea05afdf195ff45_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7ea05afdf195ff45_0
Size 487KB
SHA256 d561ec675db3b3e4ad07ce32ba4dc15ac4ed8a1a4a3518c12573d71956978532
MD5 ff84fd5b0dc98b18e94b464b9f2fc1d8
SHA1 ec2ce991a9a4ada387c3e5e62136fc11a0fc59ca
SHA512 56b7529d1c3c952c30e085160d129b9fd12493027155e8f3d865ae2c296c23f610ff7ba69827cb5f00e20d2898fead29aacea582f4306633d513220eeb2aa609
SSDEEP 12288:D8/dJF4irjBhd1qTkIqzSU5TVTPf+MBGYa:DQn22jBLwgIiz55bz
TLSH
T122B4181A17609A63CE7617F850A78562A77190092EC3E33320E4F3367D543E25EAFD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ad821ed99a4140e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ad821ed99a4140e_0
Size 602B
SHA256 244257e866ec4b89e756ece46830ba6de865aa1d06c251e76a05b1c5feaaaae1
MD5 68b58fce8dace6fb36060b87172da566
SHA1 46974d1b2a9bba385ca20023287ee850d8317961
SHA512 b1d80a06c6c659cc0c97e599612e4a6cb1eae63b7b7e7b7b59ba6590b358bc29bd16dcb9bfebc3be7f122251abcbbd826a13314d7c965999a24cf516bff8b099
TLSH
T18BF0415B0644765CC42E2BF88196726286B3C4808C7ED5A3E09E24702340AB99A5C0AB
MD5 SHA1 SHA512 TLSH

Submit Download

b8172cb9cbdea81a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b8172cb9cbdea81a_0
Size 283B
SHA256 988ef578d2d411d5855cf11d4fece002d93f9314468021841d3f01116375bbee
MD5 f69feb85cb0c9d9ecb6a6db2e989b1ac
SHA1 6dad8fe4b3b2510f7730aa014a521598b74c39ed
SHA512 e3185bc199159ae789be62a113c191a35a76feab191b3c3b0ac9cf4acd92fd84705055d6348fa4e96a9efc225f775db3dbdaffe2c790992dde1101b433a6dbfe
TLSH
T170D02B5BA1196990DDBC5EB2DB66A2919323C0489D5FA5D5910B20B351144756A4C133
MD5 SHA1 SHA512 TLSH

Submit Download

bf5c8a0eb674d132_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf5c8a0eb674d132_0
Size 525B
SHA256 b6a287c9b50a664e3e480a20ee99384e17f0b280f3e1789bbe55435b60a6c179
MD5 d7974f7dad12b064c5562c56f1207bfb
SHA1 82d86df873f0f1fcd7677f2a67ed081130e71933
SHA512 a4d4f1d97d477f8b8c0e935caf8adcebeac4b8e8e23b162409b25438797fdca03109e3cfdac0d86537d623fbe925714c5d0b2df7eed0a2eb5118527f81c37900
TLSH
T1BCF0C09B406B951DFA6F7EB5E757E542CD07901AA97DA2CB401360332051935914C500
MD5 SHA1 SHA512 TLSH

Submit Download

f527f498635387b2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f527f498635387b2_0
Size 2.6MB
SHA256 e0122ffa06fa6ceb1ed859f4615c160a8f29eb8fc3e3ef0de59ed531c7a9d021
MD5 d8da4550c08c7349b7a699851410607e
SHA1 65e57a8e22f5bd835cb258e50c7255e7e4633e8a
SHA512 3525402fe7ccd09afcd9ee3daeb2dff2df8769aa13e3be0d401412bbc5ae914a0f129359e2c0201d9bb66f91edd69d2bcc562ecbf0dcdd23aa60ec76440bfcbe
SSDEEP 49152:ONPsO5gl97a1e1b5T0fMYJknZXCRbEHZ7mDn0L1UxUPe:QPs6S5TTeknZSR+T
TLSH
T105C539151760A966CE2617F651A38917B33580083FC3E72361E5B33A3C593F29F9ED8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1b637a731b82c0668567026694f0748727c5fe525524423f10b6ae6907004628
MD5 62c65d3baa2af2d4b402bfe1861c10ff
SHA1 33ee62a14129824651427eabddafa520913af3e6
SHA512 706ec084046bb6101b6269f14452e5800ddcbb4e98fcc573605d488be47e680117c3573c641edcf12bc16c88d9d97bf831e840e7c71ce65924e204ffba9e33b9
SSDEEP 192:sxZURkyM/jK1Ml8Mji/fks9QwjEdpL+X3FP/W6+WNi7UzQprz29/YBGkqGIgyJ:sxZUm7i/fks9Q5gBb7Qrg/6O
TLSH
T12252D806AA34697B8CDBD219F911BB57D6F545B392900E44AEFC891C04E7BEC230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c271f0442b426efcc7f53656a89a4a9ecca901714dd048d53f7a6026a51e7a25
MD5 f913f9f4a561edbe9a3a8dd12b70472c
SHA1 211bf0c4ce2f231b297790da2108b7b65f200d98
SHA512 f2fd2cb82a16d90b3fe58d5f808702a4534509361dfa1fb7d056c6d5629b5ddaf23edd7ae7a66883d1b8fc388047dcf31791cc47c11a71bc0411cd46074fbbbb
SSDEEP 768:QrW7k+0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV85LlWYSjXroI8CWYu:QrW7k+0Wvqidau1jan5LA3jEsu
TLSH
T144E2FB3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6fbc24ccd3730a23d61c28a4634d41500052fbcf126ee5719e0732f501f2af57
MD5 02d0b1c26303d7ea3f6ae0a76d1178af
SHA1 0d79bce1bf4b06f4ec41de3323ed333d823e5741
SHA512 a462998bdfbeaabaf924af009517a88e7582cbd07f72a9f423c274a7681e2ef5a5a0892a99235408b543dcddd094cdecaf9d75d3fb8a4fdea4e4b17901b249fc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcYGIvKx:KIbCKcbwQKxKmmH6KEI3GkKx
TLSH
T1CE918715717A0A9238BE3889B259A7375F4231633214B46F3FF804664E6BE214DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5b8c34cdf79bf06ec7e657920c11b9bfd833b78ae7a200f306c6cab0b8e86c8d
MD5 70b9dd652776401f08c1e09ff0808d03
SHA1 a92586a8e3cfa09656ab3972f94ecfb72277588e
SHA512 28ff387b3330eafaaea8fcd673261c89898e819ae3ffcea8fafe8704f42a003b37625c987348b4259ef08223fe5b7af89460c357bf45cfb8d606fdbf7ccb139c
SSDEEP 192:uuSsXsNEFQ1MmBb/cdQmiU1hKLPYaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nZXsNEFMMIbkbDWwCsmF+23tUNWZZ
TLSH
T1A3422A316C7AAC379DA6F115F58A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d36a9892674f4a109261606bd0904dce545b3b5f08e91609f5cde5257a81ed78
MD5 352ed4ed6cba3b50f725080571fc2404
SHA1 4c2bced2e0ebc994ffe3d2e8d3b47f68e9320233
SHA512 8831ad7dec75e7c0c371ad8ac550829755aa6ae05f670d3ae752a2ffd1be54aef76f943af2c007c46dc4776f7c6dcd6b9a0c1364d0ed96b4a5e6bb5ce4a1c222
SSDEEP 192:WON164B2QmiUy1UtE5GBPKpcCsmdb+23LWwNsqqpU6:WON16eS0GE9smF+23XNWU6
TLSH
T1D812F974A869AC2B5DA6B111F48A37575FE8117BA9849F40F6E81B1C04DB74C3B0A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8331126724fc1c9e951506a4bfdf8ab50b2710c8584fc2d89504c4c7d00d1920
MD5 f1adbf3bb1777624521635697f996808
SHA1 73f713aa1c44d58bb8c744b481a6fcf6a8008efc
SHA512 0d7069e29ae297713b267a4466178313122fd0106b9033baa169decd574c14aafc24bf3b1f25c6792a8407d54e395c3a5d306f7caeaa932a7ba1324881ac9dd2
SSDEEP 192:uuSvsNEFQ1MmBb/YQmiU1hsLaNaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nosNEFMMIbQDA6CsmF+23tUNWZZ
TLSH
T1104229306C7AAC379DA6F115F48A37675EB821BBA9C44F44EAD85B0C009B39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 996a65f4fe682bf707c45ece2f591aefd8ab5a64ceee0e22ceb2ed9b4f1966d8
MD5 d5cb808770f895ee8e1b6085c1ba82d1
SHA1 ced0bc8bd50ea2efbfafe0c4c5c0cd99f90ec2c1
SHA512 a27c852dc7d208ccd239c7c5fd266ccdc4c4698aebae3cccdf6efe8fafd9192343427227bade4d3cb4aa1313cfe6a73cd57d593b9d8bc05b7b8370875fbefb27
SSDEEP 192:uuSzsNEFQ1MmBb/uQmiU1hQL+BaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nssNEFMMIbiD8qCsmF+23tUNWZZ
TLSH
T145422A706C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 41b81dd6bfd0292d5ddbc7632c27722ad68516f3e5360e92eee95c67925ac4da
MD5 af5b85ae18c2e0fb154ed68a5d830b74
SHA1 34aabf49891ea58639e884f184376fabfeb00199
SHA512 41a214f0e1e4e613cbac6b2b08a0fb756caf3cc9583a221ca12b7c79cb76ec4c576a5cb1a93a9a3b1e730302ebf6a82017ecde14b73292a46af055da4127d44f
SSDEEP 192:uuSzsNEFQ1MmBb/0QmiU1haLjsaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nssNEFMMIb8DGYCsmF+23tUNWZZ
TLSH
T10D422A306C7AAC379DA6F115F48A37675FB821BBA9C44F44EAD85B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 22200885225f430befc44ffd33ae0fb60a41ad411642501528a8ea2c1171e093
MD5 cbd8c789608aed94b777c163e7d6816c
SHA1 53972562c07ac1193b9f407c0ae68534106c7976
SHA512 0b15696899ffc4f6f53bbd74ba085616f2b5a6c95934c900d421ca1933dfecac992875d79c2254791f47481c4259bf59c1bf6f53a0a05e908859c58463e422e8
SSDEEP 192:uuSIsNEFQ1MmBb/CQmiU1hIL0baGBPKpcCsmdb+23AC2dNNsqqpuXEZ:n7sNEFMMIbGD0OCsmF+23tUNWZZ
TLSH
T194422A306C7AAC379DA6E115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 95ec57111f74d2e8ea8c18e7e3f2fed9371e1c70d15382d826030b29441be63b
MD5 1555d59f972bd6a86c233c9918e82106
SHA1 46278416a6b0b3eecc54e70403b084eb10b5958f
SHA512 4e5b41f78737b7282f026aef22c7a9015f3ec8d3303a8079e512b91dcbda1ea9eb0be3ca8c7a5c0249df06ea97e7abed77dbc6c102ba2de7c3ae19df78d14e99
SSDEEP 192:uuSUsNEFQ1MmBb/AQmiU1hhLXkaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:n3sNEFMMIb4Dd0CsmF+23tUNWZZ
TLSH
T1E54239316C7AAC379DA6F115F44A37635EB821BBA9C44F44EAD85B0C00DB39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 478cf76772bef518d1ddf15906d319c898c305ff7266e3df81896a7e03416b49
MD5 c75de72fd2c062dd79387d2b3cc7a93a
SHA1 4cb250822fbec35b060e17e46bc52a6f54e6eab5
SHA512 79c79fdb73666eecc7995a01188abd4df425c269ca3a94f30e7b483cfd660e03fa2ef8b668c01c876cb4cc34a5f1dd746c453da710c046b74a55ebf7be4000d0
SSDEEP 192:uuScsNEFQ1MmBb/AQmiU1hML9uaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nfsNEFMMIb4DgwCsmF+23tUNWZZ
TLSH
T18C422A316C7AAC379DA6E115F54A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 aa877ff014aa9d91e47107f392db1caa4c206424666495f8fcd6660009e6365d
MD5 e7c214184c2760da6cab7bd5792f2040
SHA1 3cc3c0e085e157e2be61048ec0e3f64cecd24023
SHA512 a6ef2a4086d93cabea1f82ee9c9f481fb34080975b1384a37efa6aee2dfa909c508b42fa31036bb8b2d56fc23e1e570584ddd0b7d38d847e113dfe4935eaef50
SSDEEP 192:uuScsNEFQ1MmBb/cdQmiU1hRLehaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nfsNEFMMIbkbDtmCsmF+23tUNWZZ
TLSH
T1F8422A316C7AAC379DA6E115F54A37679EB821BBA9C44F44EADC5B0C00DB39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 eb04cc0ed1730296ee551146ad0322a6464e504a4d659e3a8b53318f4467ddb9
MD5 4f76ab42054b717fe991f1412e4b1dc6
SHA1 2a14ed644d9b32f6e4662eb6704ddc28b2840fb6
SHA512 d1b28bd3d8bd5cf3ca12331e51199b8c313901c706614c6e9546e5012a2b17775675da46c2e64abbd34c4968ca372ce0d221070c46183e9ad1678490191ce157
SSDEEP 192:uuSlsNEFQ1MmBb/kQmiU1hgaLGtaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nisNEFMMIbcDgG6CsmF+23tUNWZZ
TLSH
T1C7422A716C7AAC379DA6E115F44A37675EB821BBA9C44F44EAD85B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e1c3989b85e4f6deff386a35527f7425f147ca3ff795e687913f9606c271fcc4
MD5 abe419c51776c1dbe3c92ddf6756db3e
SHA1 24fd5e855740e3e41933dce2174e5d90c4a53d26
SHA512 e16ad9811b1716c83881bed71a227613c7d0d73085981b3823713ebbdd34a7cda5f1916a52ac5d1185f656eceac0c309d1952828695069aba395d0bba4c44587
SSDEEP 192:uuSVsNEFQ1MmBb/pQmiU1hgHLl6aGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nqsNEFMMIb/DgrICsmF+23tUNWZZ
TLSH
T186422A706C7AAC379DA6E115F44A37675EB821BBA9C44F44EADC5B0C00DB39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9479bcbca6b1c7d41e7fe1be94e0814e9e86358c93565969e0b8c8f07ad966c7
MD5 23a177dec22045719fdbecde6b50bb8d
SHA1 5a71b685d15275a9c41966da29704eea1385e68d
SHA512 19ef183f522fa2225e0c613324845e34b2c6446b1de2fe5d1c00c53b91aa3acd05ee31ba0884716ea2992daf8babbec20f5273b58098cb02f48bfb8a6d3b62aa
SSDEEP 192:uubQTsNEyQ1MmBb/DQmiU1hgbLxuaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nbOsNEyMMIbdDgHACsmF+23tUNWZZ
TLSH
T1BD4239706C7AAC379CA6F115F54A37639EB820BBA9C44F44EAD85B1C00DB39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7b3c54ea6975a05dddcdcd734c2ad5c0f6956fde5fe2b46ba321ef86eb5b310a
MD5 7a4b8e7e455f69e1b18c8ebae58de77d
SHA1 ef7812e2dafe2b358a379887ab2f9744c8c3382a
SHA512 5674a85f3aa1837244fa23918649fa11b056c5eee648849ee588c46f674f59429ef86c3bce3988aed7937a9bef3f06d07c1a1285abf30c723553283618365ea9
SSDEEP 192:uubQpsNEyQ1MmBb/DQmiU1h2LnIaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nbmsNEyMMIbdD6ICsmF+23tUNWZZ
TLSH
T14E422A716C7AAC379CA6E105F54A37675EB811BBA9C44F44EAEC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 53bfd1a252bd7df562581c10d025801b8dee4a324010a855aff38e7e1ca30bfc
MD5 25fa5549dec6f5fceda795c5817745ec
SHA1 6f0f297e71f12d45bb382dfbe4aacffb028574d9
SHA512 572ba75ff1c381210492d2ae438e6edccbb0f339c894254df0f622540a8e7a4858817fedb29608310d5aacc329626c99001790c52ad372af4c62024b9c3f8f54
SSDEEP 192:zAONE64Bb/iQmiU1/1Lp/aGBPKpcCsmdb+23LWNNsqqpU9:zAONE6ebG15hCsmF+23SNWU9
TLSH
T109220A74AC69AC379DA7B114F48B37635FA8117BA9849F44FAE81B1C00DB38C374A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88d84f0f464ff202d452dd38557f0b1cac235e409d6a660ec8fadd22c23c7a30
MD5 dfc596a80219df98e78fd38cc9ddfdf2
SHA1 654a89f7e41ad75657e437b8fb7a977c2292e71b
SHA512 c3022ab2c62c2b00b294fc699645133bb0880940ac5966168694fe1a1877c76e1b5e4a8977661bb822c4c122252adac2070a2d3847e7754df3951181a45f1f5c
SSDEEP 192:MONH64BAQmiUyS1tW5GBPKpcCsmZaDNCFU6:MONH6eA9LW9smSNmU6
TLSH
T15A02FA34AC796C7B9EB3BD05F48637176FD8112BA5945F44EAE82B1C00D768C234792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9f2d2a31684ce146ed8cf4f3b0ffdb3568ee3b8ffd8839a7302259bf5b553cb6
MD5 3fe846a9d916fa3f6d4cf66dbf94180e
SHA1 70fcd6d1f19f02ff1eb5a91c18dc904a7fea06f1
SHA512 b68cc745281873d0e029aef6123c9aa2e152ac4c1bda757294bb24e8b8400a01dcc80a0df618fb28545dd2f15ae3e384dbb40998e48f2dfa026c663a367df250
SSDEEP 192:uuSvsNEFQ1MmBb/NQmiU1hxLJaaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nosNEFMMIbjDNwCsmF+23tUNWZZ
TLSH
T144423A316C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a9da53d6096469fb3f3ba3bc217802cfccf6cc3e12382a0841466a6867c64cee
MD5 50d888ac60266d2c80d9b2e276078f9a
SHA1 175b8083ee22dd8ecf840901d11cc9591a7beaa2
SHA512 7ddda52294fc47e5e6332fbaa0a2a23a5ebb09a667b1a8665cbbd5ceaa05a065fdc54012d777ef7aa1b865826f0ecbbbf20107a03e54fc27b8e199e96b2b3933
SSDEEP 192:uuSusNEFQ1MmBb/uQmiU1heLQraGBPKpcCsmdb+23AC2dNNsqqpuXEZ:ndsNEFMMIbiDC2CsmF+23tUNWZZ
TLSH
T1AF423A306C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B1C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c677b664ff5168d6836d37253d8a4a88bda83c1e284bcafee76229e75f5d6745
MD5 733fa42fe1a78b2ec23f70703be39a69
SHA1 1a16629719af1db84dc25ee244d2a1b98a615321
SHA512 85cccf508cdc2eb8b533588cfa3af9059fd88f6c043de9311b2da46013d9aba2f52a9ae7a4105e8a1d867b78fb52716424b65851f516793e099068addbe48ada
SSDEEP 192:uuSsXsNEFQ1MmBb/kQmiU1h3LwLaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nZXsNEFMMIbcD76CsmF+23tUNWZZ
TLSH
T112423A306C7AAC379DA6F115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b013a9cdab518bf8b4812cf6ec36a806b34cfa502fb59cadfa1bbe8c32ecc08b
MD5 008ad3944cdd18d8a9c9cae4ac3e8d17
SHA1 c8eb1af2f8cadb8eb07bebf159495c7572cf2358
SHA512 4f5c804c1e424e4b969e42b6cfc51a29968d51eafed3349454db91b7b1ca9acea19465f31d0eecc01f23a130f54d4486d51c7b27036f9cb0f260bd5a817044dc
SSDEEP 192:uubQVsNEyQ1MmBb/0QmiU1hghL3UaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nbwsNEyMMIb8DgdECsmF+23tUNWZZ
TLSH
T1D0423A706C7AAC279DA6F115F54A37639EB821BBA9C44F44EAD85B0C00DB39C270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e4de167cd9b97b1f24718d08155f8c77f1462fc062417a0d303d2303e93b5fe0
MD5 24f6167b6cf5ad57c7a7a348af68f271
SHA1 b955601d460488abe3411aabfcd8e42ce4149f7f
SHA512 3c225209a01f968378ee310f483714e6dc583646d470cdbefb24e536d0623ff36c46a689cdd0a7a2120c614bf28c316e63a30579f4989155e6a8cb357725801d
SSDEEP 192:zAONE64Bb/iQmiU1/AL18UaGBPKpcCsmdb+23LWNNsqqpU9:zAONE6ebG1M1HCsmF+23SNWU9
TLSH
T181220A75AC69AC379DA7B114F48B37635FA8117BA9849F44FAE81B1C00DB38C374A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 3abdf686bfd8f00cc64edf84abdd6ecbb29f441a4cde89bca2dbb514cc9dda51
MD5 f8312c63247777ba50079e8284b08158
SHA1 79a42b82cb1ec9ccd441ff233633c0fb0e72a126
SHA512 f26138f6515199e34c641b523d8dee767a4152f8b40b026c1a0d2f0f826add367ddff3655f4102de4440a8e27711f63d4430b30d153082991c69a1a2ca50e169
SSDEEP 192:zAONE64Bb/iQmiU1/zLbZaGBPKpcCsmdb+23LWNNsqqpU9:zAONE6ebG1fFCsmF+23SNWU9
TLSH
T148220A74AC69AC379DA7B114F48B37635FA8117BA9849F44FAE81B1C009B38C374A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a82dda8941ab56c75ad260c9fb2a156b901df434015338287d86b1f494cecaa5
MD5 3147dbe0d652241c7ca248ec7acc9c2e
SHA1 985fae9a3d68930162cac525d20b05e3ff884fe2
SHA512 01ca9b00fa525242837af605187554fece69ef8a2c3b37568492085dfd6744d80175f0db368c9d66f0f0b9e6a282f3ec08ec388e9903bc7c86346a53db53c5de
SSDEEP 192:zAsNEOZQ1MmBb/IQmiU1/SLwyaGBPKpcCsmdb+23LWNNsqqpU8:zAsNEOZMMIbQ1exCsmF+23SNWU8
TLSH
T100322A706CB9EC278DA6F114F48B37635FA8107BA9849F44FAE85B1C04DB79C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 988874589c63796ef0ba02cf4588f042d55593a89e558f3c2cfc4eb3dff4038a
MD5 b6c741d3d1778372a9fd2fcfa9f534fa
SHA1 45d7c28ee4928a93786dc1234d891b0f9999935f
SHA512 f2c2ccb2b49a1eda1a73605b50d3676fd57ee270ad8d58f7c2c2acda98f7847e0fc4d930571ec6970a52adcfff919aacdb8e31ed3988e35b81144978d12c3f20
SSDEEP 192:uuSKsNEFQ1MmBb//QmiU1hcLeNaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:n9sNEFMMIbZDQ0CsmF+23tUNWZZ
TLSH
T1DD4239316C7AAC379DA6E115F48A37675EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a324f1f6cd8d155ea777296855345de0745192dd20e24697ad0c6b9cc423c54e
MD5 d7875deebd0aac789a93a3570bdc89ef
SHA1 d1d82c166ebc5abd5c31789d3ca59ce563065469
SHA512 5b5d5233d1f8ec53116af2742070637e45dfb75374905fb0d3aefeb76f5b0c29af827c046928e4db79f75736df60fca79dee0d3e65835ebad0b0edfae78b4b77
SSDEEP 192:uuSVsNEyQ1MmBb/0QmiU1hgcLYnaGBPKpcCsmdb+23AC2dNNsqqpuXEZ:nqsNEyMMIb8DgQ6CsmF+23tUNWZZ
TLSH
T154423A716C7AAC379DA6F115F44A37639EB821BBA9C44F44EADC5B0C00DB39C270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0dd4cdbf-638f-4a8d-ad47-9a78f8aae820.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0dd4cdbf-638f-4a8d-ad47-9a78f8aae820.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d385cd83fd480ebb4cac27c5417b7dcec5ff73a3cd3ea24e31fadd41e8b90c34
MD5 215a7a2b70e808c8e45db71a5e46e930
SHA1 3851ac2c3dfe88b89c680b89d9ff1a2da88df3ef
SHA512 c3106894400ab2c6a7be930047d250294d4fa16fb145b03d71922397f09743410204f096d1f8918a81dcd1864e3fd9f4f752d4747071876e6627142143b0b0fc
TLSH
T1EE412A88AAF9214873777F569BF7A86E547AB9772F06C45E00110E4F0A67B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\VCRUNTIME140.dll
Size 94KB
SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 a87575e7cf8967e481241f13940ee4f7
SHA1 879098b8a353a39e16c79e6479195d43ce98629e
SHA512 e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
SSDEEP 1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
TLSH
T144936B4A76A442BBD06BD274C1E34A1AF770B8408B3053CF03B686AA5F67BE15E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_bz2.pyd
Size 84KB
SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
MD5 4fdf3bc5548f98264ccedca2e400e8ef
SHA1 9254a0a3f16a0dabc11504bbd8bd3b425702a0b6
SHA512 3bc15f142da4708c9e564fded1207f9502c5efb93c63e9db34caa931ee3d628c3eef66dc2adb42d796f7a2e1908bbe26d917aecd151fbc241d9efc67c8a7f63d
SSDEEP 1536:U7Sz7efjsrb7QMpfQKeGPHMD6p4fu718oVABfx1iE3nBZIuMVzbyjS:UeztXcUfAG/MD6pUu76oVax1iE3BZIuu
TLSH
T19E838E92F3A056F6F09BF1785661474BE731B80D4390C3BFA2A8429B1F12B517D6932E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_decimal.pyd
Size 265KB
SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
MD5 2dabdd7b03ee2d8328fad17bc9cf9970
SHA1 b609d222807eeff2dc4ea3a6ab4c36a9bf2067a4
SHA512 4d89f284acd6118fd0a5081cb52dfa8f4453a7980e04b91e4592f8f05fe620729db2bd9178b7df61c1b0b0990096780a81f49414a551b3d9bef6397f3342c60a
SSDEEP 6144:thn7Ki4/DOyyraBcGaWdK9iaweDmLsdmg9qWMa3pLW1A1AomNaZ:OiSOPraBxVKdyLsgiN6aZ
TLSH
T1F6445B56A3490CA4EA73807899979B47E7F278940360D7CF43A48AA73F53792737E348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_hashlib.pyd
Size 64KB
SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
MD5 cc06750ac9811e6b0ebe1482c032b0cf
SHA1 db0e43e4c0082d44b9385d6d94a68ecc72fd99e7
SHA512 ededec073f5651cdf2f0ed6a74278b0df630871f2ccad7d831a908a7e3efa4e5bed96d38647706add29963a515c9a13051f1457ae934d5ff75129e41bb4cd8dd
SSDEEP 768:QDyWRAgSG1MbRSoc0NK5ERnzJXkNeQWC3YcOKPte7F8dCmjDzoxIuYIh6DG4yjXE:SnuSqe4h3QV3jOqm8dCuzoxIuYIcyjU
TLSH
T11253494A968400E4D87741BDD8A31E97E671F5102701A7DF83A4C28F2F23BD367BAB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_lzma.pyd
Size 159KB
SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
MD5 ce4a35fc25d50497e8be0e75ff8d61b3
SHA1 19325e4bfe74289f062b657df082e47ac7bc14eb
SHA512 380b2be74d440b44c0abad4cfe3cddffbb36ca53d844dfe262b869cff0309f0758a86d220eb8c19eea4f18e823906c90ca2c8566e8e59e5c3e25ddc9d149cdb9
SSDEEP 3072:YaV4kBVeMMbwjQneCHPDLORDEUznfo9mNoRrL4rEZIuD1N2:YaV4kBVHMKQZrUDEKwYORwrEW
TLSH
T189F32886B394F0E6F3328C78DA624F17D6F578190320929A02CD877D2B1F7755A2A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_socket.pyd
Size 78KB
SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
MD5 439b4d756cde64fba441e640df56dd60
SHA1 881dbf2366915399b3bb8be6083f94f46eebaaf7
SHA512 ef4b78e9f6cc740696836062dffa956ee5b9d1f0be8d809497ea778fea80761fc5b3baa938756344edc18dbaeeae6fe660f2ee8fcc25e0d7985e55f4461e3c33
SSDEEP 1536:ABCJoimjxvExWxAd9/s+++prjDmrpZMP4kVIuBw/yyO:Tai6lfAd9/sT+pDmrbWVIuBwY
TLSH
T11A735B01A6A051F5E673C076C6678F23F7B0F4801394A39F4164DA6A1F237C2AE3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_ssl.pyd
Size 151KB
SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
MD5 5e2ee0a0277ffe2bd854abb898310d43
SHA1 774cf06c1e6f68c86bf107353e3f4e9df0ec40dd
SHA512 4b593b35373d69b59dd01164e09919862ac76f0e38a97fec458265add610a0dc9bca7287462668eea5b312c741e3c3644019df2f31b20bc6f764c95c968792bd
SSDEEP 3072:++WZEKFRXUxwSYQyDiyqoIpy07jhpfsEW74OH70NmHh4kwooSLteSdN1SG4ZIuM/:+oKFRXUxrZyDHKvhp2744DthN1SG4k
TLSH
T125E37D43B2441AF7E813E4BDC2634A02E7A4F105231197DE85D6DA860F07B46BE6BF67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\_uuid.pyd
Size 23KB
SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
MD5 c6ced76f58eb9bcc88dfea9b4a11d974
SHA1 de636f32fa2e32785b2dbbd697ae8e0bce3c6540
SHA512 7fc5d18ed6165713164aaa6e84377517d5f8c3129bbf65659952a5ee108bebd4da27b1a40053885577bc2cf478fa60cf73e0c97f5b0b2cb0fe63b5712385c80b
SSDEEP 384:ATcuByPxXyessdszCkPTZIuDwSeDG4y8m3EhKn:AwCidsBPTZIuDwnDG4yj0hm
TLSH
T1DBB24A95AB9048D2ED778171A0B18E0BAA71B6114724C3EF232DC2540FA27C2717F7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\base_library.zip
Size 711KB
SHA256 8a83ecc21cee6f9af303b2e03eb3b88cc86663455a6636ab288381ddc8afef2d
MD5 0440f4aa9429ce96e9dfe534a3bd4e2f
SHA1 523c84203b2889008830a00d813c1276cbb5835f
SHA512 f418b2d04b1f0f2b78da1a387ed6dc6bd46a2cff9a38dd27792fa44dbdfb559aa5464f9b41862db2d7d0801528d641c2e7c1961986cd214c5351cff6401e0a23
SSDEEP 12288:tHV0cfk10axJkldphcfyEFPl2osQNRs54PK4I1OoQDSDS:pV0cfjsJkldMfyEL2osQNRs54PK4I1Or
TLSH
T1F8F4F9807EA56DC7FD09F37D812ACA1C1A6A5378DF88D9036D43C39A3C4A3D41D66A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\libcrypto-1_1.dll
Size 3.3MB
SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
MD5 63c4f445b6998e63a1414f5765c18217
SHA1 8c1ac1b4290b122e62f706f7434517077974f40e
SHA512 aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
SSDEEP 49152:6uTKuk2i4IU6ixsOjPWJJrf129Pr1+leV6E3AH/vgpdbZ/NPL0asQa1CPwDv3uF3:6XH+n9Z+1obZ/10asv1CPwDv3uFfJLx
TLSH
T1C5F58D5AA3AC1184E5FAC13CC9574727E7B1B45A83B09BDF08A681780F27BD6363DB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\libssl-1_1.dll
Size 678KB
SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
MD5 bd857f444ebbf147a8fcd1215efe79fc
SHA1 1550e0d241c27f41c63f197b1bd669591a20c15b
SHA512 2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
SSDEEP 12288:EwIGh2Hjnl6uk51iNXuAX7TBElV57sldbeMR29XxSNreSZYrRnU2lvzsT:Uk51iNZyMR+keSZ6U2lvzsT
TLSH
T1E7E43A95ABB514A9D9E6C17C8A534A33E3BAF41413309FCF0661893E0F177D82B3A758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python39.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\python39.dll
Size 4.3MB
SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
MD5 789b4ecbce732a7e8479e8909f097d16
SHA1 a79c2e1ca0ad675a48f3bba0fbdeff1b888f0e74
SHA512 b9b57ff21735c06f4b3957cdd5a3ab54602a7141f1792de52aea0e6fc41be957070b958ab75b1a26a302b6fb17a02e9a187ad289a6af0c72a5ade43b4bf06e6d
SSDEEP 49152:RvVhdnYR7v/ZWQqC/KVBCNE4LWKFj7X6YMpYwgzxsDnfu3pbSLIlTrr4z9IE3uju:/2v/ZWrVVYRKyIFCDHuoPHVM2bwYJk
TLSH
T138267C22A35401A4DAB79477C5278707DBF2FC512B20E34A41A4BAD52F73BA317EE706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\select.pyd
Size 28KB
SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
MD5 db414debf94abe8d159f42f71fd4c292
SHA1 1b585a565d6c769a9323885d0f3af2038fb06dfe
SHA512 16a35bacd1511a327dd490304b48d7b2b87e906e693283950c46b3ae4da5db1f68d50b937f3e31329d106e92751456a9f31637495b2b8190b5f2a4a49c9146a5
SSDEEP 768:OYyAU1265whK9HqQOc+VIumGHDG4yjfhs:u86GhWKQOc+VIumGhyj6
TLSH
T112D25C55AB6428D2EA77C131A4D19F0FE934B6174710C3CF5269C2691F237C27ABE3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI11322\unicodedata.pyd
Size 1.1MB
SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
MD5 8a888fc01d0ed182f4c6e3ddc27665eb
SHA1 1c5af90831ca65c4ece4c0b23110ad81c28d281c
SHA512 e3f85f612a02681d972f26683ee69b9f454497e0c32e8d44a8cc63fa496604467a3be3cd924fdb503d1eb6c9af030d44c462da0bdffed3d83e6b42c211ddc19a
SSDEEP 12288:yezMmuZ63NTQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uom7:yezucZV0m88MMREtV6Vo4uYom7
TLSH
T164355909B9C24EE2E89B067940D3117B2F61C1720F1B6B4F76A5532D9C763A34EEA53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uqdm8duu.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ecw209x9\uqdm8duu.exe
Size 5.4MB
SHA256 914729ac77aa63fa2161ca7063007d56e4319c4baffc4c75524a79a380207c8c
MD5 7768f21b61f37da7915076adcdd83791
SHA1 c11f5f35c8b62f17c6fd52b647ca2b839fa3d91b
SHA512 c80821d27d37180978d70bf763da1a023e8bc1c15e5ade406946113c8e1d1f02f2c99f8c44eeb4183028b901aa838a32183b9b6b6bc289a0ed58e49aa458b3f8
SSDEEP 98304:CAgtqXICDtPfeE/jowqK5LN1KQ0oTh2M9QrABlolllWHkM/2i6vUV:E+ICteErownP0oTcMsABqlUutv0
TLSH
T10A463308B3A80DE6E6B3D13985565121E972B4254BB0D1CF03AC9A662F777E0AF3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4252-824-0x0000018FD3730000-0x0000018FD3A7D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads