hxxps://gamecrackhub[.]netlify[.]app/

Analysis

user interaction
yes
max time kernel
96s
max time network
112s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/04/2026, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gamecrackhub.netlify.app/
Sample260423-xwdwxsf14s

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 31 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6268	powershell.exe
6372	powershell.exe
5132	powershell.exe
3348	powershell.exe
5552	powershell.exe
5572	powershell.exe
5560	powershell.exe
6736	powershell.exe
7072	powershell.exe
5704	powershell.exe
6616	powershell.exe
6928	powershell.exe
5948	powershell.exe
3408	powershell.exe
4424	powershell.exe
1576	powershell.exe
908	powershell.exe
7088	powershell.exe
6064	powershell.exe
5540	powershell.exe
4688	powershell.exe
528	powershell.exe
5456	powershell.exe
5344	powershell.exe
8	powershell.exe
5524	powershell.exe
5004	powershell.exe
6240	powershell.exe
6004	powershell.exe
3524	powershell.exe
6528	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6820	netsh.exe

Executes dropped EXE 7 IoCs

pid	Process
1528	Tomodachi life living the dream_Installer.exe
2444	Tomodachi life living the dream_Installer.tmp
5112	tomodachiSetup.exe
2440	tomodachi.exe
6180	tomodachi.exe
6224	tomodachi.exe
5672	tomodachiSetup.exe

Loads dropped DLL 21 IoCs

pid	Process
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
2440	tomodachi.exe
2440	tomodachi.exe
2440	tomodachi.exe
6180	tomodachi.exe
6224	tomodachi.exe
6180	tomodachi.exe
6180	tomodachi.exe
6180	tomodachi.exe
6180	tomodachi.exe
6180	tomodachi.exe
5672	tomodachiSetup.exe
5672	tomodachiSetup.exe
5672	tomodachiSetup.exe
5672	tomodachiSetup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
155	ipapi.co
154	ipapi.co

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1388	tasklist.exe
5952	tasklist.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Tomodachi\unins000.dat	Tomodachi life living the dream_Installer.tmp
File created	C:\Program Files (x86)\Tomodachi\unins000.dat	Tomodachi life living the dream_Installer.tmp
File created	C:\Program Files (x86)\Tomodachi\is-3MB1A8ENOK.tmp	Tomodachi life living the dream_Installer.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping428_1961270400\manifest.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6268	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomodachiSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomodachi life living the dream_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomodachi life living the dream_Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomodachiSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6848	cmd.exe
7164	netsh.exe
5816	cmd.exe
5856	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3912	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1528-607-0x0000000000930000-0x0000000000A4D000-memory.dmp	innosetup
behavioral1/memory/1528-616-0x0000000000930000-0x0000000000A4D000-memory.dmp	innosetup
behavioral1/memory/1528-790-0x0000000000930000-0x0000000000A4D000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 18 IoCs

defense_evasion

pid	Process
5716	taskkill.exe
6292	taskkill.exe
5688	taskkill.exe
6776	taskkill.exe
5216	taskkill.exe
5516	taskkill.exe
6372	taskkill.exe
5548	taskkill.exe
5544	taskkill.exe
6944	taskkill.exe
7068	taskkill.exe
6068	taskkill.exe
6976	taskkill.exe
5248	taskkill.exe
4828	taskkill.exe
5520	taskkill.exe
6888	taskkill.exe
5268	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214452026664167"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{503526E5-9170-4A34-9011-74A2DFC50B70}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2444	Tomodachi life living the dream_Installer.tmp
2444	Tomodachi life living the dream_Installer.tmp
5112	tomodachiSetup.exe
5112	tomodachiSetup.exe
1388	tasklist.exe
1388	tasklist.exe
5968	WMIC.exe
5968	WMIC.exe
5968	WMIC.exe
5968	WMIC.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
5524	powershell.exe
5524	powershell.exe
5560	powershell.exe
5560	powershell.exe
5552	powershell.exe
5552	powershell.exe
5540	powershell.exe
5540	powershell.exe
5572	powershell.exe
5572	powershell.exe
5540	powershell.exe
5560	powershell.exe
5552	powershell.exe
5524	powershell.exe
5572	powershell.exe
6832	WMIC.exe
6832	WMIC.exe
6832	WMIC.exe
6832	WMIC.exe
5672	tomodachiSetup.exe
5672	tomodachiSetup.exe
5952	tasklist.exe
5952	tasklist.exe
6912	taskmgr.exe
6912	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4000	7zG.exe
Token: 35	4000	7zG.exe
Token: SeSecurityPrivilege	4000	7zG.exe
Token: SeSecurityPrivilege	4000	7zG.exe
Token: SeRestorePrivilege	3676	7zG.exe
Token: 35	3676	7zG.exe
Token: SeSecurityPrivilege	3676	7zG.exe
Token: SeSecurityPrivilege	3676	7zG.exe
Token: SeDebugPrivilege	1388	tasklist.exe
Token: SeSecurityPrivilege	5112	tomodachiSetup.exe
Token: SeIncreaseQuotaPrivilege	5968	WMIC.exe
Token: SeSecurityPrivilege	5968	WMIC.exe
Token: SeTakeOwnershipPrivilege	5968	WMIC.exe
Token: SeLoadDriverPrivilege	5968	WMIC.exe
Token: SeSystemProfilePrivilege	5968	WMIC.exe
Token: SeSystemtimePrivilege	5968	WMIC.exe
Token: SeProfSingleProcessPrivilege	5968	WMIC.exe
Token: SeIncBasePriorityPrivilege	5968	WMIC.exe
Token: SeCreatePagefilePrivilege	5968	WMIC.exe
Token: SeBackupPrivilege	5968	WMIC.exe
Token: SeRestorePrivilege	5968	WMIC.exe
Token: SeShutdownPrivilege	5968	WMIC.exe
Token: SeDebugPrivilege	5968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5968	WMIC.exe
Token: SeRemoteShutdownPrivilege	5968	WMIC.exe
Token: SeUndockPrivilege	5968	WMIC.exe
Token: SeManageVolumePrivilege	5968	WMIC.exe
Token: 33	5968	WMIC.exe
Token: 34	5968	WMIC.exe
Token: 35	5968	WMIC.exe
Token: 36	5968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5968	WMIC.exe
Token: SeSecurityPrivilege	5968	WMIC.exe
Token: SeTakeOwnershipPrivilege	5968	WMIC.exe
Token: SeLoadDriverPrivilege	5968	WMIC.exe
Token: SeSystemProfilePrivilege	5968	WMIC.exe
Token: SeSystemtimePrivilege	5968	WMIC.exe
Token: SeProfSingleProcessPrivilege	5968	WMIC.exe
Token: SeIncBasePriorityPrivilege	5968	WMIC.exe
Token: SeCreatePagefilePrivilege	5968	WMIC.exe
Token: SeBackupPrivilege	5968	WMIC.exe
Token: SeRestorePrivilege	5968	WMIC.exe
Token: SeShutdownPrivilege	5968	WMIC.exe
Token: SeDebugPrivilege	5968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5968	WMIC.exe
Token: SeRemoteShutdownPrivilege	5968	WMIC.exe
Token: SeUndockPrivilege	5968	WMIC.exe
Token: SeManageVolumePrivilege	5968	WMIC.exe
Token: 33	5968	WMIC.exe
Token: 34	5968	WMIC.exe
Token: 35	5968	WMIC.exe
Token: 36	5968	WMIC.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeIncreaseQuotaPrivilege	6064	powershell.exe
Token: SeSecurityPrivilege	6064	powershell.exe
Token: SeTakeOwnershipPrivilege	6064	powershell.exe
Token: SeLoadDriverPrivilege	6064	powershell.exe
Token: SeSystemProfilePrivilege	6064	powershell.exe
Token: SeSystemtimePrivilege	6064	powershell.exe
Token: SeProfSingleProcessPrivilege	6064	powershell.exe
Token: SeIncBasePriorityPrivilege	6064	powershell.exe
Token: SeCreatePagefilePrivilege	6064	powershell.exe
Token: SeBackupPrivilege	6064	powershell.exe
Token: SeRestorePrivilege	6064	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
4000	7zG.exe
3676	7zG.exe
2444	Tomodachi life living the dream_Installer.tmp
5112	tomodachiSetup.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
428	msedge.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe
6912	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6784	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 1868	428	msedge.exe	83
PID 428 wrote to memory of 3912	428	msedge.exe	84
PID 428 wrote to memory of 1276	428	msedge.exe	85
PID 428 wrote to memory of 1276	428	msedge.exe	85
PID 428 wrote to memory of 1276	428	msedge.exe	85
PID 428 wrote to memory of 3204	428	msedge.exe	86
PID 428 wrote to memory of 3204	428	msedge.exe	86
PID 428 wrote to memory of 4036	428	msedge.exe	88
PID 428 wrote to memory of 3744	428	msedge.exe	89
PID 428 wrote to memory of 4036	428	msedge.exe	88
PID 428 wrote to memory of 4036	428	msedge.exe	88
PID 428 wrote to memory of 3744	428	msedge.exe	89
PID 428 wrote to memory of 3744	428	msedge.exe	89
PID 428 wrote to memory of 448	428	msedge.exe	90
PID 428 wrote to memory of 2452	428	msedge.exe	91
PID 428 wrote to memory of 448	428	msedge.exe	90
PID 428 wrote to memory of 448	428	msedge.exe	90
PID 428 wrote to memory of 2452	428	msedge.exe	91
PID 428 wrote to memory of 2452	428	msedge.exe	91
PID 428 wrote to memory of 2728	428	msedge.exe	92
PID 428 wrote to memory of 2728	428	msedge.exe	92
PID 428 wrote to memory of 3908	428	msedge.exe	94
PID 428 wrote to memory of 3908	428	msedge.exe	94
PID 428 wrote to memory of 3620	428	msedge.exe	98
PID 428 wrote to memory of 2680	428	msedge.exe	97
PID 428 wrote to memory of 3620	428	msedge.exe	98
PID 428 wrote to memory of 2680	428	msedge.exe	97
PID 428 wrote to memory of 952	428	msedge.exe	100
PID 428 wrote to memory of 952	428	msedge.exe	100
PID 428 wrote to memory of 2216	428	msedge.exe	101
PID 428 wrote to memory of 2216	428	msedge.exe	101
PID 428 wrote to memory of 2216	428	msedge.exe	101
PID 428 wrote to memory of 2556	428	msedge.exe	103
PID 428 wrote to memory of 932	428	msedge.exe	106
PID 428 wrote to memory of 2396	428	msedge.exe	107
PID 428 wrote to memory of 932	428	msedge.exe	106
PID 428 wrote to memory of 2396	428	msedge.exe	107
PID 428 wrote to memory of 4168	428	msedge.exe	108
PID 428 wrote to memory of 3784	428	msedge.exe	109
PID 428 wrote to memory of 3784	428	msedge.exe	109
PID 428 wrote to memory of 4852	428	msedge.exe	110
PID 428 wrote to memory of 4852	428	msedge.exe	110
PID 428 wrote to memory of 2444	428	msedge.exe	129
PID 428 wrote to memory of 2444	428	msedge.exe	129
PID 428 wrote to memory of 4020	428	msedge.exe	121
PID 428 wrote to memory of 1952	428	msedge.exe	122
PID 428 wrote to memory of 2424	428	msedge.exe	123
PID 1528 wrote to memory of 2444	1528	Tomodachi life living the dream_Installer.exe	129
PID 2444 wrote to memory of 5112	2444	Tomodachi life living the dream_Installer.tmp	131
PID 5112 wrote to memory of 3172	5112	tomodachiSetup.exe	132
PID 3172 wrote to memory of 1388	3172	cmd.exe	134
PID 3172 wrote to memory of 2784	3172	cmd.exe	135
PID 428 wrote to memory of 4732	428	msedge.exe	136
PID 428 wrote to memory of 4732	428	msedge.exe	136
PID 428 wrote to memory of 3136	428	msedge.exe	141
PID 428 wrote to memory of 3136	428	msedge.exe	141
PID 2440 wrote to memory of 5756	2440	tomodachi.exe	142
PID 5756 wrote to memory of 5800	5756	cmd.exe	144
PID 2440 wrote to memory of 5816	2440	tomodachi.exe	145
PID 5816 wrote to memory of 5856	5816	cmd.exe	226
PID 2440 wrote to memory of 5928	2440	tomodachi.exe	148
PID 5928 wrote to memory of 5968	5928	cmd.exe	150
PID 2440 wrote to memory of 6016	2440	tomodachi.exe	151
PID 6016 wrote to memory of 6064	6016	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gamecrackhub.netlify.app/
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbfa7fc188,0x7ffbfa7fc194,0x7ffbfa7fc1a0
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,17943206525969199613,18124064164511721245,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7865394512389844215,8967365930396820643,262144 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,4440173214056034782,14892089872524737939,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,17510935266667440900,817059924612648968,2097152 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11322257382748851809,8606537336577044202,2097152 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,4776363905966135710,11287613387892592372,2097152 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,2257625722680043447,16541679249041031016,2097152 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,11030589844328452309,11190446888775840594,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,2196339170925940845,18163501819212722201,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,7785049509224012066,9311433418628669786,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,17752215771418177191,5813925358618761418,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5400629568190770888,18031672584278344780,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6280,i,315004324456938810,17375319291758983402,2097152 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14032334837367797327,4595414125712476475,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14032334837367797327,4595414125712476475,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,1162321252694433495,17281983098572945561,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,2331606515476861912,14546404498093122753,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,4184025134947426317,16122876893290511955,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7500,i,11316951715119760713,524892251994488484,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,3140465530722962948,5414662903884592429,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,15699934053666100983,7813418442495391186,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,9144591267390878052,17237893259123308528,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,9773464198754890841,7029929198774242390,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,8008091244598026502,9977300712038713828,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,11488469990498114159,11826191945927267552,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,6472797403944523823,14079397414479391620,524288 --field-trial-handle=2256,i,4894810315664822631,7867701650077379616,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1756

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Tomodachi life living the dream and riujinx\" -spe -an -ai#7zMap21256:148:7zEvent6082
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4000

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Tomodachi life living the dream and riujinx\*\" -spe -an -ai#7zMap15938:438:7zEvent15810
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3676

C:\Users\Admin\Downloads\Tomodachi life living the dream and riujinx\Tomodachi life living the dream_Installer\Tomodachi life living the dream_Installer.exe
"C:\Users\Admin\Downloads\Tomodachi life living the dream and riujinx\Tomodachi life living the dream_Installer\Tomodachi life living the dream_Installer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\is-FJ2GX2SJGV.tmp\Tomodachi life living the dream_Installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FJ2GX2SJGV.tmp\Tomodachi life living the dream_Installer.tmp" /SL5="$30300,92720982,1108480,C:\Users\Admin\Downloads\Tomodachi life living the dream and riujinx\Tomodachi life living the dream_Installer\Tomodachi life living the dream_Installer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\is-1ECM2PX6Y2.tmp\tomodachiSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-1ECM2PX6Y2.tmp\tomodachiSetup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq tomodachi.exe" /FO csv | "C:\Windows\system32\find.exe" "tomodachi.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq tomodachi.exe" /FO csv
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
    - - C:\Windows\SysWOW64\find.exe
        
        "C:\Windows\system32\find.exe" "tomodachi.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784

C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe
"C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "openssl version"
  2⤵
  PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "npm -v"
  2⤵
  PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pm2.cmd -v"
  2⤵
  PID:5264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "yarn --version"
  2⤵
  PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gulp.cmd --version"
  2⤵
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "brew --version"
  2⤵
  PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tsc.cmd --version"
  2⤵
  PID:5416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "grunt.cmd --version"
  2⤵
  PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "git --version"
  2⤵
  PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "apachectl -v 2>&1"
  2⤵
  PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "nginx -v 2>&1"
  2⤵
  PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mysql -V"
  2⤵
  PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "php -v"
  2⤵
  PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "redis-server --version"
  2⤵
  PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "docker --version"
  2⤵
  PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "postconf -d | grep mail_version"
  2⤵
  PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "mongod --version"
  2⤵
  PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "perl -v"
  2⤵
  PID:5400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python -V 2>&1"
  2⤵
  PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "python3 -V 2>&1"
  2⤵
  PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip -V 2>&1"
  2⤵
  PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "pip3 -V 2>&1"
  2⤵
  PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
  2⤵
  PID:5288
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -version
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:6784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc -dumpversion"
  2⤵
  PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c ""undefined\VBoxManage.exe" -v 2>&1"
  2⤵
  PID:5308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bash --version"
  2⤵
  PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "zsh --version"
  2⤵
  PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "fish --version"
  2⤵
  PID:5356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "bun -v"
  2⤵
  PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "deno -v"
  2⤵
  PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "node -v"
  2⤵
  PID:5512
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Service | select caption | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command $PSVersionTable
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gci \"HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\" -recurse | gp -name Version,Release -EA 0 | where { $_.PSChildName -match \"^(?!S)\p{L}\"} | select PSChildName, Version, Release"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5552
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5596
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:6776
- C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe
  "C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\tomodachi" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2616 --field-trial-handle=2624,i,2370761134687547386,14808008612007519768,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6180
- C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe
  "C:\Users\Admin\AppData\Local\Programs\tomodachi\tomodachi.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\tomodachi" --mojo-platform-channel-handle=2668 --field-trial-handle=2624,i,2370761134687547386,14808008612007519768,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:6848
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:5536
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "gcc --version"
  2⤵
  PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:6408
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5744
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:6248
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:6084
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:6944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:7004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:7068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:7156
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:6888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:6256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:6580
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:6284
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:6976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:5396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5436
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:6880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:6292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:6524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:6372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:6800
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic product get name,version,vendor,installDate /format:list"
  2⤵
  PID:4944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic product get name,version,vendor,installDate /format:list
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM tor.exe"
  2⤵
  PID:6308
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM tor.exe
    3⤵
    - Kills process with taskkill
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM waterfox.exe"
  2⤵
  PID:3892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM waterfox.exe
    3⤵
    - Kills process with taskkill
    PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM arc.exe"
  2⤵
  PID:548
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM arc.exe
    3⤵
    - Kills process with taskkill
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  PID:6680
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
  2⤵
  PID:5612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall show allprofiles state
    3⤵
    - Modifies Windows Firewall
    PID:6820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled""
  2⤵
  PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | Select-Object -ExpandProperty AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn""
  2⤵
  PID:3100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1 | Select-Object -ExpandProperty InstalledOn"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA"
  2⤵
  PID:4224
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1""
  2⤵
  PID:1792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-VpnConnection | Where-Object {$_.ConnectionStatus -eq 'Connected'} | Select-Object -First 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:5160
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:6936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')""
  2⤵
  PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match 'S-1-5-32-544')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA="
  2⤵
  PID:6252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnACAAJABwAD0AQAAoACkAIAB0AHIAeQAgAHsAIAAgACAAJABjAD0ARwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdAAvAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMATgBhAG0AZQAgAEEAbgB0AGkAVgBpAHIAdQBzAFAAcgBvAGQAdQBjAHQAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAAgACAAaQBmACAAKAAkAGMAKQAgAHsAIABmAG8AcgBlAGEAYwBoACAAKAAkAHgAIABpAG4AIABAACgAJABjACkAKQAgAHsAIAAkAHAAKwA9AFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AE4APQBbAHMAdAByAGkAbgBnAF0AJAB4AC4AZABpAHMAcABsAGEAeQBOAGEAbQBlADsAUwA9AFsAaQBuAHQANgA0AF0AJAB4AC4AcAByAG8AZAB1AGMAdABTAHQAYQB0AGUAfQAgAH0AIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAGkAZgAgACgAJABwAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAdAByAHkAIAB7ACAAIAAgACQAdwA9AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAFMAZQBjAHUAcgBpAHQAeQBDAGUAbgB0AGUAcgAyACAALQBDAGwAYQBzAHMAIABBAG4AdABpAFYAaQByAHUAcwBQAHIAbwBkAHUAYwB0ACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAIAAgAGkAZgAgACgAJAB3ACkAIAB7ACAAZgBvAHIAZQBhAGMAaAAgACgAJAB4ACAAaQBuACAAQAAoACQAdwApACkAIAB7ACAAJABwACsAPQBbAFAAUwBDAHUAcwB0AG8AbQBPAGIAagBlAGMAdABdAEAAewBOAD0AWwBzAHQAcgBpAG4AZwBdACQAeAAuAGQAaQBzAHAAbABhAHkATgBhAG0AZQA7AFMAPQBbAGkAbgB0ADYANABdACQAeAAuAHAAcgBvAGQAdQBjAHQAUwB0AGEAdABlAH0AIAB9ACAAfQAgAH0AIABjAGEAdABjAGgAIAB7AH0AIAB9ACAAJABkAD0AJABuAHUAbABsACAAdAByAHkAIAB7ACAAIAAgACQAbQA9AEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgACAAIABpAGYAIAAoACQAbQApACAAewAgACAAIAAgACAAJABkAD0AWwBQAFMAQwB1AHMAdABvAG0ATwBiAGoAZQBjAHQAXQBAAHsAQQBFAD0AJABtAC4AQQBuAHQAaQB2AGkAcgB1AHMARQBuAGEAYgBsAGUAZAA7AFIAVAA9ACQAbQAuAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEUAbgBhAGIAbABlAGQAOwBBAE0APQAkAG0ALgBBAE0AUwBlAHIAdgBpAGMAZQBFAG4AYQBiAGwAZQBkADsAUgBNAD0AWwBzAHQAcgBpAG4AZwBdACQAbQAuAEEATQBSAHUAbgBuAGkAbgBnAE0AbwBkAGUAfQAgACAAIAB9ACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAgAFsAUABTAEMAdQBzAHQAbwBtAE8AYgBqAGUAYwB0AF0AQAB7AFAAPQAkAHAAOwBEAD0AJABkAH0AfABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEMAbwBtAHAAcgBlAHMAcwAgAC0ARABlAHAAdABoACAANgA=
    3⤵
    PID:5740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled""
  2⤵
  PID:5980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpComputerStatus).AntivirusEnabled"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3408
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-WmiObject Win32_logicaldisk | select Access,Caption,FileSystem,FreeSpace,Size | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5456
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_VideoController | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5344
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gp \"HKLM:\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*\" -ErrorAction SilentlyContinue | where MatchingDeviceId $null -NE | select MatchingDeviceId,HardwareInformation.qwMemorySize | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:6268
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance win32_desktopmonitor | fl *"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6240
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorBasicDisplayParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7072
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::AllScreens"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7088
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance -Namespace root\wmi -ClassName WmiMonitorConnectionParams | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6736
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "gwmi WmiMonitorID -Namespace root\wmi | ForEach-Object {(($_.ManufacturerName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.ProductCodeID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.UserFriendlyName -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + (($_.SerialNumberID -notmatch 0 | foreach {[char]$_}) -join \"\") + \"|\" + $_.InstanceName}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
  2⤵
  PID:6124
- - C:\Windows\system32\reg.exe
    reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
    3⤵
    PID:5888
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:5724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:6280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:3876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6928
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list"
  2⤵
  PID:6496
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,instanceGuid /format:list
    3⤵
    PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10""
  2⤵
  PID:1928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-MpComputerStatus | ConvertTo-Json -Depth 10"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6004
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_Process | select-Object ProcessId,ParentProcessId,ExecutionState,Caption,CommandLine,ExecutablePath,UserModeTime,KernelModeTime,WorkingSetSize,Priority,PageFileUsage, @{n=\"CreationDate\";e={$_.CreationDate.ToString(\"yyyy-MM-dd HH:mm:ss\")}} | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3348
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_PageFileUsage | Select AllocatedBaseSize, CurrentUsage"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1576
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_processor | select Name, Revision, L2CacheSize, L3CacheSize, Manufacturer, MaxClockSpeed, Description, UpgradeMethod, Caption, NumberOfLogicalProcessors, NumberOfCores | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:908
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_CacheMemory | select CacheType,InstalledSize,Level | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
  2⤵
  PID:6112
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Get-CimInstance Win32_OperatingSystem | select Caption,SerialNumber,BuildNumber,ServicePackMajorVersion,ServicePackMinorVersion | fl"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5704
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "(Get-CimInstance Win32_ComputerSystem).HypervisorPresent"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6528
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -InputFormat Text -ExecutionPolicy Unrestricted -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.SystemInformation]::TerminalServerSession"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4424

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5760

C:\Users\Admin\AppData\Local\Temp\is-1ECM2PX6Y2.tmp\tomodachiSetup.exe
"C:\Users\Admin\AppData\Local\Temp\is-1ECM2PX6Y2.tmp\tomodachiSetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq tomodachi.exe" /FO csv | "C:\Windows\system32\find.exe" "tomodachi.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7084
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq tomodachi.exe" /FO csv
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- - C:\Windows\SysWOW64\find.exe
    "C:\Windows\system32\find.exe" "tomodachi.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6912

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
PID:320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 d919ea043cd0296b339de495110408f5da1c2919daec112725c1780f6e446caa
MD5 b83d585d1ea57e9c22468f842adf85e4
SHA1 9d2c2448259f9817ed3a71601b92b23d0c5c0830
SHA512 8ea678cd5100d50eef0f9833a2c04084770cc08ea0f5c811c955a835c5594337117dfbafd5cad0603c9cb1dd35c7565f5b1e41897ad0ffa0a16ad8035a93bce8
TLSH
T16171CD313275B0D4C95A7F07192C19C063BF4396EA98AF5CB65C521ED92750B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5bda7a4acde298b84944249ed34d5f4674b498a9ab3f35787c59b8f7a9a1aaed
MD5 dfc8ac88f96ffe8348bce76837920954
SHA1 787d07afc824d92e954563b275efb5a49c6fc276
SHA512 72be7e33e6964b22ed7243503c858ab3f3c02b7c8a4a188b612a13618c3bdccb35c49ee49690b28e188ac7a585df290375e609eae08846e2359f92e3e6054b90
TLSH
T13ED0805D52B39C21CDB6D5B004053F453656D557554B9356D4323C381C5314159C12D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9dc0e8e0b3744cd2688352565f359bc3c2a3049763bbb5af7d458c7c14fc65c8
MD5 4a181341ed5806b77c1ba57a47d171f7
SHA1 34371d7deb64a3224bb6528cd2b0853bccdff309
SHA512 d6b7c787c9227af20082a7c78c2be50c64a0e6b7705d189840149b9f139092b6de707919723bbc294dd1635b975f8e198a2a11b77251b5558d265bfa5bca2baa
TLSH
T1F3D0805D12F39C21CDB6D5B004053F453656D557554BD357D4323C380C5314159C12D7
MD5 SHA1 SHA512 TLSH

Submit Download

773938f9-9f98-459c-9c19-bbf09cc3ec4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\773938f9-9f98-459c-9c19-bbf09cc3ec4f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0abac337d31f0def49c8b813a447f8d465e562ac428a1151c2c33bf6cce7f4c6
MD5 6f0508ee52cd59af25dde6d2e73a7dcf
SHA1 3c6495a17de3580ad91b524c746cac1bc7cf12e6
SHA512 e70b1196cd652d062b677bd026ed3a433b9d839dfe353fb895564c94318bffa0f3a357db65b351ff7807798c7fa40e835aacd67e0e18b91c7c5cf1077dcb109b
TLSH
T121613D698C838C38EBE062B31ADF30407D35EEB8468ABE5901E0AC7D8656B217E444D7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585e48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585e48.TMP
Size 3KB
SHA256 8d6d40c96e372b7d323778d10f53eac1dea646db8e72738aa88ede7e29535a3d
MD5 d687cf63d19422dd7d9e159b6960cc6e
SHA1 051b8f112999a36bb774e3ecc9982938375db3ab
SHA512 f5a76c9cc1d82fff932d45fb1acd9d30d375e0e2428c80f1ceb67cd022acaaad11f69bbbe1f89cd82195845d8882d0fec3a8254f848206aea2a1be5e12d3e180
TLSH
T127612E794C838C38EBE062B31ADF30447D35EEB8468ABE5A05E0AD7D4656B217E444D7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a559f9cc0301fc3a90a724020d4beef598888bbf6417a28fb8a98099856369e6
MD5 df8482983659f423c991325265ac0d48
SHA1 9aef075207ff77e4008d246c5277c1dcceb47ce0
SHA512 31ad5932174576826b678bb2e7374a3937ac5659632b5de40cee3a1e2384efc3383720f56a17eb06e7ce5ce9cee96064ac94f2df78eb109a67ad5a7554a8315e
TLSH
T10961C0F7C3E8866DC91259F0AA187E2BCE2C0915472C3C5A89E4EF5797E2871D101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da32b2e83b7137fab64491d43457db6af5c834d2bfe48584e9cd6eab15ed6004
MD5 1b1d6e35b66b1d93c2d5c2a9359060ab
SHA1 b9afa3fd3e1272ac5d6d2ee0fcaa6d78700d80af
SHA512 f50ab19b130dbc71286c38af3633dc33534c96f3fe9725e15d55a0a5611e2878f92f362e024accff605a25cec46d20f5d5f175313edfc75645725b00f862611d
SSDEEP 192:sxZ7R0yM//K1Ml8M9F/fgsHf9/gEdp6THW6+WN5LH/+f0/FVV4DIgU4J:sxZ7q1F/fgs/9/nUHbh/+sgUc
TLSH
T14952E816AA385977CCDBD20DFA557F53D6F9057296940E44AAFCCA0C00E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 128b38542040a0a7fdcaa31e96b0bc8d1a15f8db7d765443e548676c6052d710
MD5 e8b5adf9b6884c1208f2e4659550104c
SHA1 a2949bbe79097b01d37791fddb332b92796f2e0f
SHA512 1aafa89e5772f125267da6c55887780d533cdd2390918853615463a836137381e9a39b1551420a486955090e6e8af69b33ad3cfb0c996e859f575b802904b362
SSDEEP 192:sxZvR0yM//K1Ml8M9F/fgsef9/owrlIdp6THW6+WN5LH/+f0/Few4DIg5KOJ:sxZvq1F/fgsQ9/qUHbh/+ogMa
TLSH
T13752F916BA385977CCDBD219FA457F53D6F9153296940E44AAFCCA0C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 37d721d53224622a8d37b3891df58c11759ba817d2b286887d17af31f76ba607
MD5 672dd4a446cbe21ecc133100e91badfc
SHA1 447ddf6d07bc8ffa2a8b0db3e4c517062438708c
SHA512 0a4c3d1447eb9936dc4ce8bb72e125f4eb230cdd0afd873a94f6f9016360866ed94b868b50c38ce87aedb010c1e7aafc3919b2704c123fdb2985e46435a86015
SSDEEP 768:3G8If87Wvjdwx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKyLlsu7FQrouOKp9JKV:3G8If87Wvjdwxu1ja1yLeQF7Ap9UV
TLSH
T1C9E20A2B680CCB7E4F841EACDC2AAF976ED801CB9694495447EA884C03C76EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 766a6bd21e29699d435a314c76dc5e6622ba42d530eb2997402b067af18c00ed
MD5 0a4ac950ea0abe0bcf0873be832df78c
SHA1 6e903b8b67ac3228264f14a86c98311307f1955d
SHA512 fbea84ac63da1323e510e79d11fa492adfd6846432528a820eb11a8b6de1989907bd05de9f8d31dcb923eca5e9a3992f5a98d3ff1bba46e873561b71532b2ec5
SSDEEP 768:3d8Ifta7pLuLn37Wvjdwx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9gOyLlsu7FQroA:3d8IftyEn37Wvjdwxu1jaQgOyLeQF7DU
TLSH
T13AF21B3B680CCB7E4F804EDCDC2ABE9B6DE8018F9698885447FA844C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 22a9c52eefe93e243da7d5cfd73de75a70dad712a885ed40360b85cdbe30ea2b
MD5 053501056eba3958d67c80fdb579f078
SHA1 d24c34057994ae31a0be14415d4e67f195b38f4f
SHA512 56cbd4ea6bf072284d7e347522b1b08910e20ef370769dadf7fbdb240339eb2b116a991dae7a968e4ebfe1a0dabcd2dc24015729fa5917cdd8208af46383bb30
SSDEEP 96:KYZOK6My+LOKUwP1mK+IiSW9H2K1T9Z2p/n6Jb:M1FJ5ZHXT9ZS/n6Jb
TLSH
T1FEB18B01727A02C439BD355591E2B92E438530923148F53B7BFE58E61F27E528EFEAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f72c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f72c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f274828dcffa68e83b95905bed8f1aa76b606b93c6ce2d14705995f14fbd392
MD5 27d5a967cca0244ae90b2192bcb31aa3
SHA1 f38c19e08ff85f579dc23a5a631e6eeb24a653ee
SHA512 6fe4c791bdda7467ad96c4b9f026dc2484301d36475a75cc86644e7519bf69aa2b5dc6e14dbb3e513e50d562a1767853ab4cd73dfa1e46523aef3178c826585b
SSDEEP 192:9ONM6s2QmiUyf9BoJ4I2LYEweF34v1rU6:9ONM6JyBoJ4I2kExS5U6
TLSH
T1FC02FA35A838AC7B8EF3AD55B8473B275FD4112BA6852F44D6E85B0C00D769C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c6b3d87f8280324c0e4c38ff0dce8ca3959246c4aacf6605276847b4f7f7c0f9
MD5 49301e983df58dddd5c42c0c7c23f93d
SHA1 d215dded2fd63451b04b747870f1a88c43fb00b6
SHA512 06ae746879e70a07cabc0c472b20029712c1453a853871ad61b83899bd9cc5364926264258e2e0a9bcd31a62556297aabe2e5b7bcdf4324067bf13569998b96d
SSDEEP 192:zqLsNlk1Qyu4V3LyQmiU1jl94jJ4I2LYEweFxYKEjL5TqmOzDOdZn:zIsNlk1W4lSHSjJ4I2kExxYF5jOzDOj
TLSH
T1B5421A3698386C779EF3AA55F9073A135FF8515766842F50EAE95F0C00CB39C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 4b4b85f0189039f9074051dfce10a038af75eb67bfc2c7365f68868bc28f0dfc
MD5 0fd4c4422f32bf0bcfbe107fd28c859c
SHA1 626db51df19432bb83430a86e19cf58019c22c11
SHA512 e1ee35313b9fec217a7ba77b2484c8f6f072613689002536a582767fc36d34f77d2e2d28b38881049ae5fde04eb60caeedcee1eaf5e4cdf2c6e8708cb92740a0
SSDEEP 384:nliFZjccCs+Bt0S3MrsN/8TUNTUlIlAkW4lZfS6Df4wJ4I2kExxYFIjOPpc1qGfE:sFZccQoawg3Gw2kE3QIjOBU0
TLSH
T15CB22836D8A4D97BAEF39B85B6077A439FE401A786C86DD0DAD95E0C00C72DD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 56ec40ac3049b4858815bf155c8df94c15e09889115042e5d66b437e89e5f1d9
MD5 e9dbd8fd28d6e947d1a41cc9c13ec083
SHA1 d2c328e377ce5a0156989bbf37f9e9f153fdf9d6
SHA512 cd30007dea2d3f7b4d6e0cce2e3d22a704ee468bdb1769999347b4b3be2c3652f377502b113d6b373b7a4105dd53b3c028580a96281de4d16c8eccc91a49cd17
SSDEEP 384:nKjccCs+Bt0S3vsNlA1W4lZfSjJ4I2kExxYF5jOPpc1qGf30:EccQP7M2kE3Q5jOBU0
TLSH
T140825B3268786CB7AAF3EE15F4473B136FB8416B66C42E50D9E95B0D00CB2DC174B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b3195cdae24670e86b829e5bec31dc8dec61dc88a3f8145b3bd8009efeda1f59
MD5 e26a96ef80a369663444d8877979404e
SHA1 2e9ce61f32e34af7cb03dcc1fa0bbc50875cd00c
SHA512 dced74adadd94944110a8d2afc5e83081b87f85a3660fe04b1a088bf6c58b5c705f47c19848b18e7a251ccca6140473645eba25dcccbd8a2430da529e5797450
SSDEEP 384:nIjccCs+Bt0S3vsNlAkW4lZfSjJ4I2kExxYF5jOPpc1qGf30:2ccQPmM2kE3Q5jOBU0
TLSH
T182825B3268785CBBAEF3EE15F4473B136FB8416B66C42E50D9E85B0D00CB29C134B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 93d82967e1ba5ed945ea35ba055d6faa249aec010468d71e6b92a784216f060b
MD5 06cd939418c7fe8b8bd98941bd1441cf
SHA1 23d472a3c483da64d22af57b4b7fa7dcb6506046
SHA512 653f002515e0531f34fe6624e9af0dec44b1f9147495003f28659196c705471dfc510191cc78ead3026d59c22964efdd52aaa29d1bd5c58f7f56f09c28487655
SSDEEP 192:wON46sBQmiUya9OoJ4I2LYEweFxYKEkc0TqmOU6:wON46Q/OoJ4I2kExxYFQjOU6
TLSH
T10712F836A8386C6B5FF3AD56B8873A235FD8121BA6852F40DAD40B0C00D779C234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5979452-1cb4-41d1-9ce2-86caa44cd864.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e5979452-1cb4-41d1-9ce2-86caa44cd864.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 d2be20d60980f44bfc1541dcd33a8a44f06b9d7a221b5d8c33f6d7a4e0d86fec
MD5 d82201a7ade08383e1fdc6f36da4caad
SHA1 3e4671414d5c0c3c35683614570301fd1af994e0
SHA512 34f5e3de674e7cd19c75b204214884f8e6d5a592131f9fe2232d6b92cdbccc48950f9659a57c1802ed17527c2995e80d31dc6465ea140708ed9b153d02fe36ad
SSDEEP 96:NeRAe2+yi+CGPCTkT/mLTmIaMJ/+GY9AFtd4BGnnDnK5:A6rCG6Tc/JIaMB+GtdeqnK5
TLSH
T111D29566B808E206DE096C76AFEBD6EC37307E12CDAA031335D1B73E49B74C64D18585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download