a6dc06b1447a9badaf5ac821ab222d301baaed9c7a13473b2f00b3a5809f8fd5

Analysis

max time kernel
12s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVR.exe
Size 99KB
Sample260805-te9eqacc59
SHA256 a6dc06b1447a9badaf5ac821ab222d301baaed9c7a13473b2f00b3a5809f8fd5
MD5 511cb12ad771939bfc6551315e605b5a
SHA1 a98d3953b226c66e0250940978a385771db08344
SHA512 da4b2605768c31c53fac7ec45cb0fc8b324049fb63f9d39f459ccd829287691aace24df4950c3ac4e2997cd4ae4c25691ca4f6f88a00cd6a9e020356e69a0eed
SSDEEP 1536:r7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfKwYTSCJPqUt75:n7DhdC6kzWypvaQ0FxyNTBfKvt
TLSH
T162A39E41F3E242F7EAF1053100A6726FD73663389724A8EBC74C2D529903AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
236	powershell.exe
6760	powershell.exe
5900	powershell.exe
5720	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVR.lnk	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2080	cmd.exe
4076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VortexVR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VortexVR.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3604	chrome.exe
4144	msedge.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	powershell.exe
4872	powershell.exe
5720	powershell.exe
5720	powershell.exe
5900	powershell.exe
5900	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeIncreaseQuotaPrivilege	5720	powershell.exe
Token: SeSecurityPrivilege	5720	powershell.exe
Token: SeTakeOwnershipPrivilege	5720	powershell.exe
Token: SeLoadDriverPrivilege	5720	powershell.exe
Token: SeSystemProfilePrivilege	5720	powershell.exe
Token: SeSystemtimePrivilege	5720	powershell.exe
Token: SeProfSingleProcessPrivilege	5720	powershell.exe
Token: SeIncBasePriorityPrivilege	5720	powershell.exe
Token: SeCreatePagefilePrivilege	5720	powershell.exe
Token: SeBackupPrivilege	5720	powershell.exe
Token: SeRestorePrivilege	5720	powershell.exe
Token: SeShutdownPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeSystemEnvironmentPrivilege	5720	powershell.exe
Token: SeRemoteShutdownPrivilege	5720	powershell.exe
Token: SeUndockPrivilege	5720	powershell.exe
Token: SeManageVolumePrivilege	5720	powershell.exe
Token: 33	5720	powershell.exe
Token: 34	5720	powershell.exe
Token: 35	5720	powershell.exe
Token: 36	5720	powershell.exe
Token: SeDebugPrivilege	5900	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4076	2316	VortexVR.exe	90
PID 4076 wrote to memory of 4872	4076	cmd.exe	91
PID 4872 wrote to memory of 4284	4872	powershell.exe	92
PID 4284 wrote to memory of 2080	4284	VortexVR.exe	94
PID 2080 wrote to memory of 5720	2080	cmd.exe	95
PID 2080 wrote to memory of 5900	2080	cmd.exe	97
PID 2080 wrote to memory of 4472	2080	cmd.exe	98
PID 2080 wrote to memory of 5756	2080	cmd.exe	99
PID 2080 wrote to memory of 3828	2080	cmd.exe	100
PID 5756 wrote to memory of 2256	5756	chrome.exe	101
PID 2080 wrote to memory of 2176	2080	cmd.exe	102
PID 2080 wrote to memory of 5792	2080	cmd.exe	103
PID 2176 wrote to memory of 692	2176	msedge.exe	104
PID 2080 wrote to memory of 1716	2080	cmd.exe	105
PID 2080 wrote to memory of 5108	2080	cmd.exe	106
PID 1716 wrote to memory of 2844	1716	firefox.exe	108
PID 1716 wrote to memory of 2844	1716	firefox.exe	108

C:\Users\Admin\AppData\Local\Temp\VortexVR.exe
"C:\Users\Admin\AppData\Local\Temp\VortexVR.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3EA5.tmp\3EA6.tmp\3EB7.bat C:\Users\Admin\AppData\Local\Temp\VortexVR.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVR.exe' am_admin
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\VortexVR.exe
      "C:\Users\Admin\AppData\Local\Temp\VortexVR.exe" am_admin
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6363.tmp\6364.tmp\6365.bat C:\Users\Admin\AppData\Local\Temp\VortexVR.exe am_admin"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVR.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVR.exe'; $Shortcut.Save()"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Creates a file in the Startup directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5900
      - C:\Windows\system32\where.exe
        
        where chrome
        6⤵
        
        PID:4472
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb8c76c728,0x7ffb8c76c734,0x7ffb8c76c740
        7⤵
        
        PID:2256
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,5669983115021306605,8736862185200859858,262144 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
        7⤵
        
        PID:1120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,16769467680685567477,14361614649312579835,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:3604
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,7383704566234338481,9263325164263025335,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
        7⤵
        
        PID:2724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,9423478857032581904,16040037607602894399,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
        7⤵
        
        PID:4572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,6797334395346976906,2043998870611493034,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
        7⤵
        
        PID:4792
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,4954642985310807499,15898321090287805173,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
        7⤵
        
        PID:1480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4856,i,17158378386281252241,14615971626607954376,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
        7⤵
        
        PID:5588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5324,i,4938263094593179366,11817892686801608714,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
        7⤵
        
        PID:7328
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,772769233945053736,17879735654403195127,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:12
        7⤵
        
        PID:7964
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5896,i,9607317348016172836,18071820865263867624,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
        7⤵
        
        PID:7556
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6284,i,4823970412617877896,861995731736513183,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
        7⤵
        
        PID:2480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6352,i,7616761616498490486,13039707856801910396,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:1
        7⤵
        
        PID:4360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6392,i,2306043486905667252,15513632334647567948,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
        7⤵
        
        PID:4664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6428,i,18106085608829800345,55988657154595940,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
        7⤵
        
        PID:8336
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6896,i,317370445798488103,16491929367440572114,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
        7⤵
        
        PID:8340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,1626361362062936784,8798842435502768464,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
        7⤵
        
        PID:8360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6904,i,10927811697349865556,871633835733142502,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
        7⤵
        
        PID:8368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6356,i,16932257004586054073,8457630869478243503,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
        7⤵
        
        PID:8204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6412,i,11897424979136827836,14931321130728171017,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
        7⤵
        
        PID:8984
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1020,i,15625662266868078616,5359526469672933816,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
        7⤵
        
        PID:9040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6600,i,4644534486812408333,17298627004070217441,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
        7⤵
        
        PID:2052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6444,i,13359607186925512891,11287202304330565510,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
        7⤵
        
        PID:5340
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6348,i,11742034823288681729,1367950126017165667,2097152 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
        7⤵
        
        PID:8660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6592,i,17551033691048427179,16235542822919685927,262144 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:10
        7⤵
        
        PID:8536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,6127932257077802997,4411327700610917468,524288 --field-trial-handle=1916,i,4267461369770024384,1373137160935383739,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:14
        7⤵
        
        PID:2572
      - C:\Windows\system32\where.exe
        
        where msedge
        6⤵
        
        PID:3828
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        Enumerates system info in registry
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x334,0x7ffb7a1bc188,0x7ffb7a1bc194,0x7ffb7a1bc1a0
        7⤵
        
        PID:692
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,10650246440196702289,713565773919283009,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,2696136197674273678,14049616772981201322,262144 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
        7⤵
        
        PID:5036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13406135188675846567,7887635701389402799,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
        7⤵
        
        PID:3252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,14129184359253004425,7365932681037142031,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
        7⤵
        
        PID:4216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,388920256630589142,12833738438189936887,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
        7⤵
        
        PID:4156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,1845871399059678437,12448303098595704599,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
        7⤵
        
        PID:5104
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,14639615954095797607,5438479704801005462,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
        7⤵
        
        PID:3312
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,8083191977149360843,614174388607842386,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:12
        7⤵
        
        PID:3308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,371912585957284657,14097292812384266788,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        7⤵
        
        PID:4932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11609753254998535629,11787836385583203850,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
        7⤵
        
        PID:4072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5892,i,159229039097024393,17225833357137208094,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
        7⤵
        
        PID:6180
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,7834385331578496224,17080783888224042382,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
        7⤵
        
        PID:7828
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6552,i,17829528885859134082,15786413693785478685,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
        7⤵
        
        PID:7516
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4452,i,12742854938654800413,8041864167561346450,2097152 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
        7⤵
        
        PID:6924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,10735074602831008093,17854057894262302404,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
        7⤵
        
        PID:8184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,10735074602831008093,17854057894262302404,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
        7⤵
        
        PID:7468
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,14882179200985069820,10460699423435346469,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
        7⤵
        
        PID:8440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,4564901624376973076,15050467604667459395,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
        7⤵
        
        PID:8944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,7241297625866276481,5128579734141422836,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:14
        7⤵
        
        PID:8952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,11362539506601045633,9870132139644163804,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
        7⤵
        
        PID:8960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,5606478119060938807,6577806254374181617,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
        7⤵
        
        PID:8724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,10502446998790023927,9143866654676947765,524288 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14
        7⤵
        
        PID:8412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5732,i,4215828031610311921,1607801321970500592,262144 --field-trial-handle=2520,i,15863465326506308008,11441691976510958226,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:10
        7⤵
        
        PID:8584
      - C:\Windows\system32\where.exe
        
        where firefox
        6⤵
        
        PID:5792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        7⤵
        
        PID:2844
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1748 -initialChannelId {c8337db1-18f6-4185-8abc-92617b54405e} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:1388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2340 -prefsLen 27133 -prefMapHandle 2344 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {20590733-f243-4053-bb9d-ddf22e9c60e6} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:2152
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3612 -prefsLen 25213 -prefMapHandle 3616 -prefMapSize 270279 -jsInitHandle 3620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3628 -initialChannelId {cface378-2ed9-4189-8ab4-4312f1c68673} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        8⤵
        
        PID:6540
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27323 -prefMapHandle 3920 -prefMapSize 270279 -ipcHandle 3928 -initialChannelId {b07f0ccd-5b39-422c-96db-c2d3c3565799} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        8⤵
        
        PID:6572
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 25213 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {3c2abffe-d48b-47fd-96fe-366d9321b6c6} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        8⤵
        
        PID:6684
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4696 -prefsLen 34822 -prefMapHandle 4700 -prefMapSize 270279 -jsInitHandle 4704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4712 -initialChannelId {854c7692-dcc0-4575-aa94-c2c20ac47c86} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        
        PID:6940
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5564 -prefsLen 35010 -prefMapHandle 5568 -prefMapSize 270279 -ipcHandle 5576 -initialChannelId {567b41cf-fa62-4268-ad9c-3fd33ff42fda} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        8⤵
        
        PID:7736
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 1580 -prefsLen 35062 -prefMapHandle 4848 -prefMapSize 270279 -ipcHandle 2680 -initialChannelId {7840fb7e-32a2-4fb2-8604-ff9de8b9bffc} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 utility
        8⤵
        
        PID:6280
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 32952 -prefMapHandle 5980 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {3e1d7b03-03fe-4cb7-a2f4-58000a6d31ca} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        
        PID:7808
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6168 -prefsLen 32952 -prefMapHandle 6172 -prefMapSize 270279 -jsInitHandle 6176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6184 -initialChannelId {46081b6e-df1d-4768-8589-e0335922d37c} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        8⤵
        
        PID:7456
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6168 -prefsLen 32952 -prefMapHandle 6212 -prefMapSize 270279 -jsInitHandle 6200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6304 -initialChannelId {0840f39c-4ff8-4a10-8dfe-4b9f0994e9f0} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        
        PID:7876
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3320 -prefsLen 32952 -prefMapHandle 3204 -prefMapSize 270279 -jsInitHandle 3304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3088 -initialChannelId {b6734761-b5e5-4626-af81-9f6d7676f7ea} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        
        PID:7204
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1120 -prefsLen 32952 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 4620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {fdc934d9-a30e-42e6-8636-82c882ad101a} -parentPid 2844 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2844" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        
        PID:5540
      - C:\Windows\system32\where.exe
        
        where brave
        6⤵
        
        PID:5108
      - C:\Windows\system32\where.exe
        
        where opera
        6⤵
        
        PID:672
      - C:\Windows\system32\where.exe
        
        where chrome
        6⤵
        
        PID:4480
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:3756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb8c76c728,0x7ffb8c76c734,0x7ffb8c76c740
        7⤵
        
        PID:5052
      - C:\Windows\system32\where.exe
        
        where msedge
        6⤵
        
        PID:2860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:2040
      - C:\Windows\system32\where.exe
        
        where firefox
        6⤵
        
        PID:5184
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:6412
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        7⤵
        
        PID:6464
      - C:\Windows\system32\where.exe
        
        where brave
        6⤵
        
        PID:6432
      - C:\Windows\system32\where.exe
        
        where opera
        6⤵
        
        PID:6876
      - C:\Windows\system32\where.exe
        
        where chrome
        6⤵
        
        PID:7084
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:7200
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb8c76c728,0x7ffb8c76c734,0x7ffb8c76c740
        7⤵
        
        PID:7240
      - C:\Windows\system32\where.exe
        
        where msedge
        6⤵
        
        PID:7208
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:7424
      - C:\Windows\system32\where.exe
        
        where firefox
        6⤵
        
        PID:7432
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:7824
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        7⤵
        
        PID:8104
      - C:\Windows\system32\where.exe
        
        where brave
        6⤵
        
        PID:7608
      - C:\Windows\system32\where.exe
        
        where opera
        6⤵
        
        PID:5540
      - C:\Windows\system32\where.exe
        
        where chrome
        6⤵
        
        PID:7408
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:7480
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb8c76c728,0x7ffb8c76c734,0x7ffb8c76c740
        7⤵
        
        PID:3356
      - C:\Windows\system32\where.exe
        
        where msedge
        6⤵
        
        PID:1960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:4360
      - C:\Windows\system32\where.exe
        
        where firefox
        6⤵
        
        PID:6936
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
        6⤵
        
        PID:7436
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        7⤵
        
        PID:7524
      - C:\Windows\system32\where.exe
        
        where brave
        6⤵
        
        PID:7464
      - C:\Windows\system32\where.exe
        
        where opera
        6⤵
        
        PID:7196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "$wshell = New-Object -ComObject WScript.Shell; $wshell.AppActivate('You are an Idiot'); Start-Sleep -Milliseconds 500; $wshell.SendKeys('{TAB}{TAB}{ENTER}')"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:7560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b8883c334ac89dc563173bff7f26fd6ea827d25207c0f3ae15678a4ab58e508c
MD5 f724aef1e7f7c0dbc86296fbe6b6b26a
SHA1 035967642cc117fca17a0ddc26f6344772191c5a
SHA512 aba387d1dde92a944308d2cb1ac73d4bac68581ba4a55fa9f7f48af493fb9c3166152397332ebeb5b707316e51a939aaaceabdaf01a184a6ae5e5472dae47803
TLSH
T165C08C812281048CCFC8337423C35D41BA221BB81133CE9FD9C0C498C4232E809120C0
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f9e2cc3401d286172813c3dfe34ccfc1560e3390e590572f428675fac432ec4a
MD5 7a4291e535a0fd2985ec93113cedab1a
SHA1 dae4e65505154809dd37f10f83e2a7cee8775efd
SHA512 a425285da04f9d365506b013ba61ee7be35b9132f1e9d3a1e2664384b8ca047f3dba6b5c2cd121dbfd37c6904af070f5367f5a91714c7b3851a9fa1e4640d62b
TLSH
T11D418CF3C3D4CA7DC90156F4AB153E2ACE6D0E18422C3D26C9E5AE1B57E28B5D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d6b6488f2de872adf18b98c7fa3ee0a69fea0d457f5ddffa0bf6e3cd8e56cd7a
MD5 8b847a2cb996d086f584f1c491307460
SHA1 2c43ffd5255190c1fd82976bf027488a880db265
SHA512 af29374f2203f3c4fec79e266bb413894cb1051306c2c1271148c70a913ac8880b614c28b804d1228315a379ae5659967a20eccb5df62de2209c7de8e329214f
SSDEEP 192:5BRGya13v7QvAPRp2o9XxHsb+WNn1xEPPt2Km4kwbVyIsnAUgR:5BRGywf86XjfwAPl2L49R
TLSH
T18032962EBE15793B6DCAD22EFA227753D7F6102125D42E84EBF89A2C11D75CC6227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 af47e9382b4731cde7dfde588a17f82e58488d9877f7b6f8faa2761e88ab9ca1
MD5 18e4896571f14ffde62c0387db35a865
SHA1 8b70ca922a27f46b18663d8650649b691ee6809e
SHA512 778a247921550d50d06bb11c8b58e173d783be1dcacd0570415ec47e09eb77d3ffd4eff8c652bc1c9692b59b4b7c67f50b77c86804796304af2330e7d1227b84
SSDEEP 192:5BRWya13v7QvDPRpj/A9XxHsb+WNn1xEz2wCbYumt2Km4kwaVyIsnAUgR:5BRWywf8jX8fwA6nbYum2L46R
TLSH
T19E42862EBD11793B6DCAD229F9617B53D7F6103121A42E84EBFC9A2C11D75CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f72571ed2334e9b89ebf01bc976e4a0d5d079bd11b30bdbcc15c939e3e6a7d00
MD5 8c1a8a2af5808279a0a1d747e6e6b9aa
SHA1 4edeffffd129553aec28cabeef475e57cb8fb3ca
SHA512 caffd59b7593e3c3fc2c64e1799d3bedc5238c60657254a2f26b7e3be4431700fa12da3b51b91ee57092f1638e9e5637423c9d6790c554e334d91052f2821d9d
SSDEEP 192:5BRWya13v7QvAPRp2/A9XxHsb+WNn1xEz2wCbYuSt2Km4kwbVyIsnAUgR:5BRWywf86XVfwA6nbYuK2L49R
TLSH
T1DE32962EBD11793B6DCAC22AFA617753D7F6102125E42E84EBFC9A2C11D75CC6227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 4d1adc4363d298088021416b1c41f8385432ea85e9ec4cce2aa2909a1c7e4e97
MD5 b84b4022c369ad111e9b09a7cdc46831
SHA1 b38578519139d66b5ea7d73f87bdd1c7e2cca4aa
SHA512 4f1addb886d5565c8f268505719b4171e6bdd750c518b52af1f2f3d0d60849a1935de2aa26e742d3baaadd9aab307ba3e6872b23f5f6ce2078595aebe12c3a77
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9W6jBTK8cH:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTl
TLSH
T1D232C727A48D9E3F4FD8D519DC026F8B6DB5029272780D24A7FF5D0403A978E214A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 5fce2b6770c541d05e2dbfa4d0c11e384f380c89f6d4ed31f039b06733ac678e
MD5 08b0dcfe1f16313c6b2993652e36bbab
SHA1 a81fd3dff84a1652b4c55b9bb4bb13cf99c71dbe
SHA512 1595793a06d014b175413ae1f3f9a2d5fb0f12d93e8bfab59c04ca1033584d3281c4057abef9c56ddb115ad9d3bf989cf28c2439c6f328b1a3ef37d25d392d9d
SSDEEP 192:RtH1ITo+TQ0IwiU290R5SIxzhjm+976UM:RtWToS2wfiIxzVmm7BM
TLSH
T1C9D14C31A46D6C7762E7E541F1123A53CEB42067CA51AFB4EED60F0C01E74EC2342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 fd6cf5c77d95ec952efd87f881c1dc2776719351f716f02e5d5285d18fc01e2c
MD5 af06bafdf36dbeaa37ee8b2e2179bedf
SHA1 a1ef3be6f1b6faeba3fac96192a1ea2c665b32b0
SHA512 b64763fa7dc72eb4751b3787a7154538b2be53ef661985ec01be4761eb5b6a7f433c7f0ba8812756b17b40f593bf30f5104ed760dbb9e5b056f2b5e279e38631
SSDEEP 3072:VCQem4wzMq+iFUc3xl4sFjprk1IWWJ2K4dB:VCQtbzMq+iFUQ4sfrkCMN
TLSH
T1E7C3128887962EB23269C540F11FD5074ABD42DFC9F0B1B1BDA58F0E20F66CE9952E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 ed08fd857d71f602af48594dd898722591b01fa689248796e89635bbc734de56
MD5 73999d9533eaa38db1e6f86d757cd03d
SHA1 33f7509fbba096d165f8bbd2e2326a4bb947e40d
SHA512 895990b8a4b27a4d86ae16bc964e4ee537584861b7e7b9280802ea988da1190337149df19578cb454f325db862b862db9169d3d8ac84317e4d2c402d8eadf050
SSDEEP 3072:zCQem4wzMq+iFUc3xl4sFjprk1IWWJ2K4dB:zCQtbzMq+iFUQ4sfrkCMN
TLSH
T1C5C3128887962EB23269C540F11FD5074ABD41EFC9F071B1BDA58F0E20F66CE9952E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 172d4cadca1d545cc81cd8597664e83e724372a4c5a75e64c68bc1377015926c
MD5 02518faa920ea03d02f57a27f53db378
SHA1 93c4d71e7d209859e940903012ac61159cd7089b
SHA512 2ff66bd7533b0081eae55c8fd37c803376c0fcb1846c5441c1b7a27ae6ec522825f3bbc9c9a5401e616c53c44efa0a6276f16216d8a6701b79ab915a15c0795b
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok55MmDwB6nGyvn0b4T87ybJv4a:xC0ITo+TQ0InDUDV0PPb4T87ybl
TLSH
T124A11935E0285CB75076D446F1626A43CFB87067E9B2AFE0EAD91E0D14F74EC2341A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 d7b119fc152f828bef46c7171a5af0beb9de422c51fbc14cc8b6e1d63dd67bda
MD5 506db34cc7296aa1f1c3554d24af8a68
SHA1 ea826c1fa0e3c0b96c9de3f507125b55f068c056
SHA512 f7d27e770b84614dc265dc5e6fc30869b20f08536c68525f1a7c74a398d83f14366b7da364661d566f8fe8b95da238c6dbb9e8718c5fa9966d3fa2c380c2f19c
SSDEEP 96:RC6e1d+r2io+TJ/E0f6m934VMPSl8h4otop55MANDwB6JGMvn0SvQxwzQIahjm+o:RCH1ITo+TQ0IwiU290R5SIxzhjm+976n
TLSH
T1F5C12A71A46D6C7762E7E542F1123A93CEB42067DA91AFB4EED60F1C01E74EC2342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 c03238dba0c8880883f7e7af34895c208a7ff2ead3132122bf52de95a51527ec
MD5 f4932c7975571947bf85d49548768435
SHA1 9515e4ef4177afc43a17377309e905b220163625
SHA512 ec6559846035fb7ce7c5c2957bce013392b7dad598b0ff54f6b99c1c35baf8877422f54ed3402432a6a27f83b474784d17c411eb9680dbf9363596d65c714773
SSDEEP 96:RC6e1d+r2io+TJ/E0f6m934VMPSl8h4otop55MGDwB6JGwvn0SvQxwzQI5hj+97u:RCH1ITo+TQ0IwiU2x0R1SIxIhj+976UM
TLSH
T168C12A31A46D6C7762A7E545F1123A43CEB4206BDA91AFB4EED60F0D01E74EC2342923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f1f27d0a6d8a536ddaab15b83cf94952862761ad1e0debd8d4927d0924f8c2fd
MD5 1df927a0cd7a88c1b355aa8576be95e5
SHA1 6c70ef6796956867911622211384e9ac754291c3
SHA512 9d943c591bc3fce9413dc0c6db327a17a44146429cb2da80ef45340f320fe5560f881aa4b0a90765e6bc6f6779b9e29256600be11bae409a5bf79a486e67e7a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T126B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 29f70f739647817f7f5478533968094fe3d4a46f458df7447ae4697d1b670699
MD5 174cb875d1c3cca46f044fdc3eb8a003
SHA1 291013c82596f04d2119a6d8af3ac46aa2125c49
SHA512 5f26bc6a70271ebf1a4babffa358b3981bb36f84606beeac8b78832c138cb4f1894329569425f224ab00c60eb145b3222c61d263cc7930875643c6736a8e8200
TLSH
T191D080B03B95F915C5452531E6905321A1515D71685B670A5110D01DDD3E1C357DF0AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b27c7b79200055e113c5605f71a04da8adcf7508ca67a79e3bbe7b76f9f06c60
MD5 2d8751272ee2d1ef035a325c672a01a8
SHA1 67b5cb58455f952c78469b46a0c4efa843935b63
SHA512 48acff097cd75734cf634b19f878fd8062fe15469ee3e4e21d54829e817744cc1ce4f5dd702a6f31f957114e56352604ab3caa2f05506ef6a59558db80a37802
TLSH
T1C9512D4D5B6D89EDD736287992E37846B6F08A3E62C35A51C3809C708D17FF524D20E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 439d55ffce879e3e5ef4930789e4fa60db42266d3919a06b84aed770cb9926fa
MD5 4f424a5bb5b49f9a4539bcad77240d1a
SHA1 a39efadfa5c3617e68aa642a8ab308a5c38f82fc
SHA512 0b17087be74008bb15a393153e46168f87ca7aa2fbd8ecc1b86e801f45b190655a638aa275448f02ba0a8abc47999e2af25a17d02be2c7f4dccffed21a11ca54
TLSH
T1BF519EF7C2E8866DC91156F4AB186E2BCE2D0A24432C3D5AC9E4EF1B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 54038592672e20bc68ac6883ebb5bc419cae465038cde12f1bda12d8d1b488a1
MD5 a765ab927bb349834ca854d66401443c
SHA1 6ae52024258165e14361b696aba3a4dcfabdf434
SHA512 53fe90ac52a344faf005a7bc1a30f003c64582d614e2433e9921352ba7db664cf94d33dbcc0d1456086ae6741e675ca98591f102769d0588b9af8f87361d1eed
SSDEEP 192:sxR4RIyM/jK1Ml8UQyq1/fRsHIwGOzoA8pXS/g6+WNPou8ZYo6ICYkGsIgDhgJ:sxR4Kqt1/fRsHIpzi/5kZCHG
TLSH
T13362D815A934697BCCDBD219FA55BF93D2F4157391901E48AAFC9A0C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0cf27397dfc4e4878851c64ecd409184ccf44763f49e71c40be57b85b41c2647
MD5 4d77b69f5fe22979f161d6fe70b154c0
SHA1 f43348e91117fe2601c69373b3062bcfaa7051fa
SHA512 b952a58387cd81c324f1a518a1033a2ecd450a4f464105c21f0df4eb3bc3c2ecbba34ab28e6d3f2df28064d90e5bf082415c67fdaa7856e163d168c7c10bc99c
SSDEEP 192:sxRTRIyM/jK1Ml8we1/fRsDKwGOzoA8p9W/g6+WNPMoRfYozcCYkGsIgV4J:sxRTK01/fRsDKpzE/5kAfzrHa
TLSH
T17F62DB15A924697BCCDBD21DFA55BF53D2F4157391901E48AAFCDA0C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6c0296e4e06520ecd9021accd05d2bcc2adef4d14c9866f00f39a6d288f5f6db
MD5 f1ade848ed06491a8ed0f55dc5f0abce
SHA1 5b3a89be3c218035c8e7e39ef62dbf21f2e00d45
SHA512 ddfa2d74350543c99856e2b04d7244bb87c2bb55aca24ce14bb710540a758ac2d68e3e45091206cc34f542ea9c45bba60e6bc8a501c9bd58bc3df5d235a9e421
SSDEEP 192:sxR4RIyM/jK1Ml8wq1/fRsHKwGOzoA8p9S/g6+WNPou8ZYopeCYkGsIgDh4J:sxR4KQ1/fRsHKpzg/5kZzHS
TLSH
T14362DA15A934697BCCDBD21DFA55BF53D2F41573A1901E48AAFC9A0C00E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c64d89c2bde7a2acf93f65a1633337220af756d5cb3807560eb6722a71436664
MD5 17a5d96d1ce95ceddce3347534367334
SHA1 86137dfaa071b2b06c339a185136bb001989b022
SHA512 748d879943128fe9b004016609b2e45ac7f89285c32d8cd5cc408cd37ee2b9e47eee56105ab1de9b82a8670e4e77b303c8da7c96d9f4824cb13a8ae53470526c
SSDEEP 768:jXwHEo7pLuL7gRWgs2f728F1+UoAYDCx9Tuqh0VfUC9xbog/OVbVuGwrockJe0Um:jXwHEUE7gRWgs2f72u1jaO4GbdiK
TLSH
T1B6E2FC7B680CCBBE4F404A9DEC29BD9E6D9802CB56D8CD9447FA840C03C6BEB55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 15710f162848bdca0bcdb17dbb46936a6bf08f3b2506435dda1fdc069848dfcf
MD5 40d300327afef54db3e96916c837c0a1
SHA1 5106b9d653b5f772ca6a1693f6da9b9c039b6a09
SHA512 7ec86aab5bcd625bed83dbdf2264922474ddecea668808c415bb9b286725175d2b39d5286e09b15f17e887a574266eb30a08469ad4b333cd8bdca34dd3ed1e50
SSDEEP 96:KR8H8Q818x8H8F818ZW8B8u80g858ZK48wg838Zc8/83828p818qH8d8q8j8X8Nr:CWLa2Q445IdGWWrgEN+W10m/Hc9oMmqi
TLSH
T18191E002357F02D13D7F6A4C8467882A428274623254E83BB7BA05A64F66E335DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59efa075-8bbc-432f-b928-e61abaf6610b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\59efa075-8bbc-432f-b928-e61abaf6610b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4a6edc56d4fe60e22809d24f19451ca4c7bb00a5d1d480c3dbacc0c99590ef6
MD5 b5e3c4210ed859e2067d34434f6617d5
SHA1 b6b5343661c9480bbbf1cddff4c4d1163033a23c
SHA512 c783f6e5499a7a55dac5ac7a9918a7e66632711c1f92015d334cea18fe7cc685073a076665754f22ec19d515762127b799653a29983fdd522dfafdf59a619e83
SSDEEP 768:hrv+4UNbdz3XN/TBOWc8IONXyer1IRCzniBVeVH1SK7:hbsbV39CSIqnuEH1l
TLSH
T11803CF32A4A89E338DE2A3C6B14777477FB86057C6800790EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 93230764bb75b2cbd10a0919c7f92357c900bad2c0632baca41fd84dca513a2e
MD5 83d7e2ff65715ff331646a500b3490c6
SHA1 6e8e99f513c33dc6f3727bc683d9f5353cf8c6e2
SHA512 a9de59beb5d20fd861657fed8261d9465a148fde8a21ffb9bd3a9fa14478fd3b360fb9c7b6aae9765500010b5101fbb9ab609fdcd1b7d32e8f454d4c656593f2
SSDEEP 768:Bmrv+4UNbdx3vP7/TBOWc8n+ONXyer1IRCzni9JeVH1SK3:obsbr3vjoSIqniEH1R
TLSH
T1E713BF31E5A89E339DF6A3D5B00772437FB8115BC6840A90ECDA2F4D069B59E230F95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 aa5faa2f1a89cc7465a96eb1ce1ce7d82d4dc6cfb7982e7e5d899a5afbb85f2d
MD5 6d66b56174775da1d46e7813f06ef2d0
SHA1 4369b8d8211ed46323a4211bab0282d930c9adbd
SHA512 6300e46b5e3c5be14504d426ca31ca34f6ee7ab057a0482bc7b337ee1428d5c0887c3ff22c8d48bf83794c9eaed5736fb5558917f25ffe4a79db34464834f83c
SSDEEP 768:htFWrv+4UNbdh3cwg7rOVsOWc8nXONXyer1IRCzni9JTZ:gbsbj3MyoSIqnil
TLSH
T191139D32E4A4DE37ADF697C2F2067643AEF41197C5C849E0EDDA2E8D018B59E130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a8b69d3fec33e57845a9e9e65fb207c8a4c545633e790d49884130e8fa6af098
MD5 ddb43638490f072b6c8fc19e56ed38bb
SHA1 446f90c66bda390a821f6e82202041d3030af1b2
SHA512 9ff2473b1593d746a4aab1c61f28085b63c568baea1660278b141d8b6aefa6dcedd5e244f869462863201aa87baa9ece3c4b9478341f98db941f13d8b91160fc
SSDEEP 768:JXrv+4UNbdt3+rp/TBOWc8nDONXyer1IRCzni9JTZ:pbsbz3+tFSIqnil
TLSH
T15403BE31E568AE338DF692D2B00776837FB81157C5C40AA0EDDA2F8D069B56E230B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f737bf2f8e7d0fb6aba747e87a25ef806be3ef40fdbdb61c369dd97694176d28
MD5 f26a3dae99103f7f1abc319b43d99487
SHA1 42b5576d9d41ceaff33d6ff18955ce3099a20cef
SHA512 58ab8fc23973dcd4aac3ad8fcecb65ab8ab1ffcd3e17464294000f3b8c980b5b5ef9e377b657bad794644942f63b9ff265134596a7a422f18184d46bc04af7ba
SSDEEP 768:lXrv+4UNbdt3qrp/TBOWc8naONXyer1IRCzni9JeVH1SK3:9bsbz3qtESIqniEH1R
TLSH
T13C13BF31E5A89E338DF693D5B00776437FB8215BC6840A90ECDA2F4D069B59D230F95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4a19e1b0ea511856e82310e3f1abdb0a688cc2db281a2005ec015f38e2c8ec34
MD5 e4e06015381f37db6588681b0f25e509
SHA1 aa6966e6f23af69951c11de4c4ad6afdea62a823
SHA512 2e4f6b249c787fedf259a0bb3f364ca974efde04d23df2f2e11ad5869f2275b60b9529e48987edee26f9cd5e8ae0fead93d6077fef96ccaa858a47bc4b5bd1c9
SSDEEP 768:Brrv+4UNbdP3rNX/TBOWc8ncONXyer1IRCzni9JeVH1SK3:RbsbJ3rxuSIqniEH1R
TLSH
T13E13C031E1A89E338DF2A3D1B00772437FB8105BC6840AA0ECDA2F4D069B59D230F95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d710c09b6e4485351972c9e57bccffe9dfec0211f526a51458360a55aa6072fc
MD5 25a387ce6a84023c8ecf4bf593a30b14
SHA1 5375884271b7f859f8bf255b2aaeaf16f6756e26
SHA512 88c13a03252de4a17abf05f8eb184c0f70a2e4d653edd356f08cd977d236eb7b199a6c6004fbde65027068fd2c154ab7be894532114e39292a0b72b536f1584f
SSDEEP 768:Bcrv+4UNbd33vIZ/TBOWc8nBONXyer1IRCzni9JeVH1SK3:Obsbx3v6HSIqniEH1R
TLSH
T1D913BF31E5A89E339DF6A3D5B00772437FB8115BC6840A90ECDA2F4D069B59D230F95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11561795-4761-4a56-9b65-04528ee3294f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\11561795-4761-4a56-9b65-04528ee3294f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c655c36a247fa9a3e91f73a167259848a9634d38bebb462380c0790540b33e4
MD5 d7022932ea3d3436deb97418297298dc
SHA1 303a8a151a4d38d13067099c8c4704f275e8d840
SHA512 141437f8bf63b93b3ae485863a87e926c8b53c9abe27bb393e1c235d3cf5bca9f9f9fa5d815331f82193cccdf8045c5376ec5bad1c8b9944f506c22892ed2256
TLSH
T16E117A33F3CC8724DC9A407650CEEC1136B6CBDB409ECE5BAB84D548B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 042406754d4ebfdb40715b26e1347a8db3db95b2b4d6a5abbeeff65cb15ba6ef
MD5 35cb5f36cbfbd055a5b3234978f40a36
SHA1 adce2c316647166e24be759df21e04cc5d819610
SHA512 264b1c4f937e4cb52a7ab66e57c1f28079ddcb22c1ec614ca93e92b06790cdc1416105cde1a866d45869bd3494296faeed87afdc96738630c1e60bf552363f84
TLSH
T1ED215733F3CC8624DC9A413650CEAC1136B687DB409EDE6BBB84D558B42F289DEA1260
MD5 SHA1 SHA512 TLSH

Submit Download

2CDA87721BF0237FA196F4CB31888454FAC8F535

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\2CDA87721BF0237FA196F4CB31888454FAC8F535
Size 68KB
SHA256 cdc73ba2843ff838efa79bc14b714f28c9ca5ed41a8d3ed9a3b8a389a58e7918
MD5 cfc300620bd760203cb4209ba0d4d857
SHA1 4ef9c48c5f2e8afd025ce5b10fa762c499ba4289
SHA512 a6d66ff813d4c7f1d7234c98f7610b2ec9c631e64279b21f4aa919ef14ab48f922ef1bbb2727ca4046c30b97cad17192afdd8af8708f7d5e373d90409cb2a2b9
SSDEEP 1536:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FtK6:Gt7S3PnrqSxnnsNvcV+FtK6
TLSH
T10963023B009E943EE7139DF1619B049A2F6008FB9FF5E7B97101562782693E9D71409D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 7139cb82c7909220dd7663d021e557b3ac4032fcad9f6b42bf9f3639920ec9a9
MD5 ef7174ae0a05c1379afb118f5264576f
SHA1 8aa6403bde4fa76c2153d5cdfb5f7da2c9c6df58
SHA512 87a7f4cb0d5edd587f1a5b5f95fda9f2d8e361b98022431a65d161bc9a8f77c59544b9abc4b1c516a76e4a3112a59766af6e784931e289e5599e803a49d60b8f
SSDEEP 3072:X3l3w6MT6lswMuh/qpPwIYi0pZj1Mgyc4:F3i69/oPRtgj1nk
TLSH
T180B3AFF6DBA28D3D55FFD42DAA92C53EFD662410B3A33009C823635462C6B787679348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 177e3a87d1153d0ed14bd8a8a9ba22db5c57c61c2e8e4538e472227e4cda8bea
MD5 17388ca33be59cd7369b5330117a89b7
SHA1 23d83629741893a8b2b33f1086bad57e2ca5a5d1
SHA512 44a9dee56ba76381fc7431611d598790a6da3c3520d35d8fb4bd510db8ecb59c370cbd2d95376bbbd9778b67bb2166552b438612346132602049b7c13e3b9e7b
SSDEEP 1536:jTrliIm/sDnPw6MTzOmVcydcvAQT27Alh9rk8NqOTgPyAwIR7CLW295yCS0JV7zW:j3l3w6MTN/H5whBqpPwIYi0pZj1Mgycw
TLSH
T1FEA3AFF6DBA28D3D55FFD02D9A92C43EFD262410B3A33009C963635562C6BB87679348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3EB7.bat

Path C:\Users\Admin\AppData\Local\Temp\3EA5.tmp\3EA6.tmp\3EB7.bat
Size 10KB
SHA256 3f0b47a31c47ac40721ee1a561fbf8f203c732ea4e11e76f528b6d8bcbd061d7
MD5 38f5cd8bdd2f39ee4e569437d1f29ded
SHA1 b19665431607c86b2193be4cf44e9c9e8b6fa9b5
SHA512 b45d29e05e630050e02c47f92ba14ddceb53329fe9e80d049d6ea0645eb7999c2fd05c2710261be7f9908d350e11ddb8968a610ce051b0783602cf14547346d6
SSDEEP 192:0cIDgDkIdDSDsDp5DdbDgDkIdDSDsDp5DdwDgDkIdDSDsDp5DdwDgDkIdDSDsDpF:+cwIdGQhcwIdGQacwIdGQacwIdGQV+8
TLSH
T18622780573C12286CAFEA6DC8AD37405E18B69320789CD85F04B64C767FCB4B71ABDA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_32y2oaxx.p4f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32y2oaxx.p4f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVR.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVR.lnk
Size 1KB
SHA256 9babda5c776a54e47179d6e6c200b41625338639a2fe4f0e659613a88a2ea25d
MD5 616d2c90c6a0969d764aa658d4ad7c3d
SHA1 c7e18fb929d96f210ee7e051314715eccf4f7633
SHA512 0b643253480e70677a8f7247cd85313dd07f7905c03e631f6e2f26e23300ee15c8ce073a1e4aa3c78f75caac8b035c800fb114379b52c95d2eaa2795cd01a910
TLSH
T15C119C2E4DC21F22C195993784EB232AD636BC14F7A66F4A0094935E2865702ED59F0F
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\AlternateServices.bin
Size 2KB
SHA256 1b2168fab9c60a63c6498bf95eb3238f31152585f0b99ef8a93b4afc2ca6c02a
MD5 9bdcf99863870295c3d92523d567edc0
SHA1 7f91e285a2be0111e67dd27e0aa4d871e1bf85f2
SHA512 33a76084a08e0723b6dceb206257c0d5acc63831a8b8dfece77e28e098d5a3746b949d6cf40766d3a4554894c882abeba746e751b6426e2b5ea039551cbc4cd9
TLSH
T185514CB781734030E2284AB8B82660048D37A3D957BE544A27A0A0622A82D9EE0FC0A4
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 67cf2dc7f49e5698b1e39868669aeb568b00d42756e2a30e149dd656abd4d36c
MD5 cadfdf891f9c72adcbda23a7dbbc62e3
SHA1 f5035f30944cde12d9d271bd8ee3d8c3aeef7419
SHA512 1b24148e8c8b4b1b342685c5f7e2856dec1e365846e4e2868d985df5e0281a414b300a9f944ec424ad81131c35c47547c094da133f15590fa97b2de2dde5daea
SSDEEP 192:aOv5zbo7SJnyjL6sHz1d66JoztdzgCl6mc0d:ZboWJnyjvd66Joz/zgC1j
TLSH
T1CDE12E64E639863FC408027BCCA61B414F39398BD84E3F1975DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f1f88773666dfc5c6958191e9e2862334428ec6726f10e3aaa7ba2bd7299e303
MD5 9a09efc48ba5dea98dd20d65a8e521d8
SHA1 d0390c7b3117bd95c8645d3cf1e8a6ca3ee27186
SHA512 f4c595df91bd0f55b71eb41e375981c2e12d6a2421b768775442cdb3e6f2245ecfa1af07b0563a38846923e10ed822d609567ae75c4a8ac1f6932482336e69a9
SSDEEP 192:mHz1d66JoztdzgCl6mc0drOv5zbo7SJnyjL61:8d66Joz/zgC1jqboWJnyjE
TLSH
T14AE12E64E639863FC408027BCCA61B414F39398BD84E3F1975DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bb8a432ae29bc3bb9611f350feae03180db21aed53446af76d5159504bb1eb43
MD5 20cfa3a00b56b0fd486aeb605daa2835
SHA1 ea8ff134c38b9b7e8289f3b61725ba4880a1f763
SHA512 a101c38cbabd4f9a095a4221408c9279382c5897040fd4d2ece510b2e45bba8840c6120d4fb4dbe0916cf00a38f37edc4c3f8657ec7158bf099a514de8bcfeca
SSDEEP 192:HOv5zbo73JnyjL6sHz1d66JoztdzgCl6mc0dz:4boLJnyjvd66Joz/zgC1jd
TLSH
T10DE12E64E629863FC408027BCCA61B414F39398BD84E3F1975DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c4fb0d0cad191f8b92826a3d0859033c6b7d43498a51cc9c58350a8cddc11e26
MD5 5f825a091d5a4c4ffae8a9233823c9e3
SHA1 cbfd205467d7bd82decb0081c37f9d1da059e90d
SHA512 80218f272f217c00f3aecb09466c9be8b34d4bbb7b5e9f2e55dfb5d9308eec81a592e1224f2683c6c2d248606e52ee389f65c9ce641028ef55f9e01152c8f94e
SSDEEP 192:3Hz1d66JoztdzgCl6mc0d0Ov5zbo7SJnyjL61:Bd66Joz/zgC1jRboWJnyjE
TLSH
T14CE12E64E639863FC408027BCCA61B414F39398BD84E3F1975DD650C2D5A2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 705a5202ffae3884f697925ce7afbe200c325d4b413a8dbf615b68d65a816c63
MD5 1cd65c925da1f3adccfa9078ff4eb35a
SHA1 885bc8d2b99a387109c913f2eaa9dc07b178068b
SHA512 208fca3a4767cad7d63ec8c0e58aa7eeb292bcdb63f4f066c41d837f10716eb129d040bd774c498b13807313db90325e5729ef4c9ab32bfdf19ac196294a6c0d
TLSH
T12B21499C39F94D6AADCBE39C7451128E93518E1606DB1C434D02EF8CCE81AD9726E83E
MD5 SHA1 SHA512 TLSH

Submit Download

60bd8ad4-255e-44c1-bb1c-62c76d5da372

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\60bd8ad4-255e-44c1-bb1c-62c76d5da372
Size 883B
SHA256 ffeb1f626f3f901d5ae43fcc0031964058947b0324c5f60ddcfae9021a9e26f2
MD5 d68bd3dada82bce2251d170f26a3fd44
SHA1 89c95b77edbf452a3dd1015a0681b8287f29cc1e
SHA512 14796be1fa12645575a3696ff073ada22f550a4c3a2ada2cb3da5198e5716335c942027bdaaef1efa8f9ac41d0e856b794a39e8338aa381b02c8667388aeecd5
TLSH
T129110040E6317A72CC28834BC9AA77128FE8B513C0C689043DA58E084E7E66FA766647
MD5 SHA1 SHA512 TLSH

Submit Download

640af842-7ae2-4106-9d22-4192b8425208

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\640af842-7ae2-4106-9d22-4192b8425208
Size 235B
SHA256 91aaec77470504f2d68bcdc2cffba734cebbe229b1e36facf7b111bf214d1cb2
MD5 fa0c42936728c8f741c1df9ad3eea8ba
SHA1 08bdb2e6715cfc8b3828091ccc114fdb67cefd47
SHA512 0cbb666b25ef7fdb3f5a083fdb3d9faa567e238427225e695fc7007ae9d7f5cd86ebe9313eb536ebbaaee9344c25a0acff521d1071e60c1fe87580ed79c76047
TLSH
T1C5D0978014E8332C08184F43B0B068D234D54C33A07868509AA10634EAF8FC90152C27
MD5 SHA1 SHA512 TLSH

Submit Download

7b9c29ea-6f32-4da4-8391-c8a02d006362

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7b9c29ea-6f32-4da4-8391-c8a02d006362
Size 235B
SHA256 4f2ea156ad166e1e2136365136ac6d0ed8cb5d6fe2ed6d6e36b5b510e74ea383
MD5 d2c285345b25f75c0b15418cea3df7f2
SHA1 5f1fe518a66352dc306567e76455e5f159226152
SHA512 59da7c0860b07371c7f1bd3f7ca9bf9d33b9374f035f582eb215b5cf3583494153bf17e7d5c7fe567a7986d1925eb4a8d04b29c4348d146a25b2aec0f2797a91
TLSH
T1B3D0A79028D87B6E48141F47F0F07DD731998C332474AC14DBA14578DABDFC551A2D5B
MD5 SHA1 SHA512 TLSH

Submit Download

a6545cdb-f430-4b0f-af60-f2e9fc658185

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a6545cdb-f430-4b0f-af60-f2e9fc658185
Size 886B
SHA256 831544d0250ddc3d1461e9c5e9642a546111e9fdbe3502f7f1c74baffc4ecc66
MD5 221057ae1afd565c38a76baa4791d4c3
SHA1 986ad40d90e594b632bfe6e68f069e4f9942db9f
SHA512 37df9efdaf7ff92eb63fa07e03c1c116ebfe6637118d4df8b8fac569f892a00ed8f3627e445f496a79496992790fd7a208ae6b2a71e736e7aa804c3cc3d013da
TLSH
T18A110440C6767572CC28934B85E5B7438BE4742380C609147D954F084D7965FA3A7607
MD5 SHA1 SHA512 TLSH

Submit Download

d969af37-13fe-4196-be31-06355f73c799

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\d969af37-13fe-4196-be31-06355f73c799
Size 2KB
SHA256 a6310764f3585e6a51c5cffad43bf4e106f52b5ce9f7ec0d5dd8babd2b655cf3
MD5 e7c6f82f57ff68ffae046afa20cc0b70
SHA1 9c18eaa9a9b9d525e769018518c7c0a9cfe6d4cc
SHA512 c5922450749170b85d64089cee057d279004cee99b738c3a507627cc52479b97a1708ce94cb2a9939515fd56203abac152f8b9d15409a90fc1fadc8890fbd8cd
TLSH
T1FD41345C35BC4C369CCAF35D959232CEA7609A0304821C832D46EF0CCEA579E236A42B
MD5 SHA1 SHA512 TLSH

Submit Download

ef63b7d6-1e7b-4ba1-9b1f-a2bd713e718f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\ef63b7d6-1e7b-4ba1-9b1f-a2bd713e718f
Size 16KB
SHA256 bf3e63668d366b8219258658567cabd1472a2a99b89cd95d006979f75c9c04a1
MD5 92906a0919773a7d1e75785676a8ae07
SHA1 543fe7cff3b584a6e40c0c80fbb1d7afb891395e
SHA512 4f70ced1ed29d4419c693029a97d5dabda37a4fe642015c4036381207cc54a07a75fe68e2e12e26e0d4170c4bd715dd188895d5b3797e6028a90610f216929a4
SSDEEP 192:KuFXxz67zxS2u/jEJHfdyc1JS8FayeLjyseJWtcNgk/6BORX11PPriI6J5A6T8:vBz67lSh/jEJH191JXD6qjLFBx
TLSH
T19372EB56586055BE8551E3A9D4FC7FC3E2F528CF4C019FCA8BE47D085DEA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 2ac52dd91378ba15a44a509deb027155cbef51b8162b6bd326a99fb4dbfee70b
MD5 aa9db8fa8265e6b0910f66d6c40c148c
SHA1 69edf1f754b0bc858a087207996904ada6604d72
SHA512 26c2efb29704cc1e9dc29534e8916d493d03b4fe077e4d09d5756981c9dfa37dcd7139692900631b91aa4d650eb0bfb20c52e93fa20b37ac8e7bcb3e60599044
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HBo4hz:NI4fRfsXH446+4V4Y4N4Q4a49
TLSH
T1F972421545048EB8298EA78BAA367E01C37D573B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 e04e051b2c4989d8b39d9bc839cee4c632be10d8f1eb0e2dd8a789f558ddd7b6
MD5 a7a80670d32a335e398275d00decb808
SHA1 a11172537bee5fe1af047727775e085a86b7655a
SHA512 c69909be47801ef1f1375ac248094ff10eb5fa9b64d55e9751d7285cfefc4f077e31a51cfbfd3ff457597ff8816a29d34d4681552ecb530c3eadc6c1f28c007a
SSDEEP 96:xHp5TUWqGqPfP+NObzSRSSlvdv9js+n+cWRF/CamBw88u8L4cnAV7wb:vMRPfP+NDSSaxRt7mBw88qU
TLSH
T1D3F1FE789104CB7F75B677ACAC688C316AB2023BB7BF68C750A95484051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 6916737debc65b7cd7403adec41c8c13b60adb83faca325659efc8237131cc71
MD5 2d21e60a1751c9c09f62053459654726
SHA1 66a28f1b13aed72e1ede7608411e217261c14f0b
SHA512 857913c025b59ec260f051f225a8b26f1b3974983f8296bcdb95cc4a2e778c32568f8f938fff5f8cae0765eb70dc5a1c3a4025d0566a277bbd1f7fcfe604b28d
SSDEEP 96:xHpUTUWqGqPf2B+N1zSRSSlvdv9jbn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B+NASSTj7/Bw88qU
TLSH
T114E1207890088F7F64B677BCAC688831AAB2013B7BBF68C750B95484015CF3441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 fba2b5d0c962df0b8f8b52dc5b87c737a0248b2b4a4db8cff9abc8456dff5dae
MD5 091bc3cc6cab8162efcc311bdb50783f
SHA1 41f08e70d3d7cc5728738501b11a3136ac79feb1
SHA512 80f5729358c1fd8fd3c5b1bae814c2bf1cb64b459785f3efcf6ef7739731496c61501af3ce38a33678d44ebcf03d601082bb1528981a0ae508cdd5d262b30ba9
SSDEEP 96:xHpUTUWqGqPf2B+NObzSRSSlvdv9js+n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B+NDSSaUj7/Bw88qU
TLSH
T1C5E1217895088F7F64B6777CAC688831AAB2413B7BBF68C750B95484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 5431a50f9d58c8e4aca7fe6abf704872dc6b4d20dcea2e2f8347ceaa70768dea
MD5 877758ef5c89ab73f7bffa5a180144a0
SHA1 8355758a6792e93528093ab07c01761ef2869143
SHA512 52aa90fee4bf89e137513b526eb454f6c917cd188f44d6200e6ac5c9d476b5e768b4d5044aa79a2d5a210f9afd59a93dd258cbd1442e22d472e9698d439b8225
SSDEEP 96:xHpUTUWqGqPf2BBr1zSLSSlvdv9jbn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BBreSSTj7/Bw88qU
TLSH
T1BCE1117894488F7F64B6777CAC688831AAB2013B7BBF68C750B95484055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 06823ff0a44da3a2e4b489c827a1146b3a73af2f6e95f449f304da50f5d6a413
MD5 cdf261a22c073468263413c076d3816e
SHA1 3b86f6fcc28e47b7f10cfb7cb7d0d2ded36455cc
SHA512 09e483a9d3e3d3cc290fcc80b9656ebbb82d0a8164e84374a44d14c18ed4e77f719d2b9fd9cf3b6d5cd620bc78bf7a861a6b21b4f0cb55f1a9eab69492922cbd
TLSH
T14C717B9388097FF4733039D4C0CE7A18E46820628A296EE44036DBA2A2197DC704C3BD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 cb991def64903ab3a33faf09d1b240570ee5bfcb154ed58e5933bdd157cfe338
MD5 450fc2657ed20c16e35dfe47cd068f3f
SHA1 5ec4fd966017c803dc9c16fc92e82325127e6949
SHA512 e18a96e7aa6bc09840d180560fa710414bdfa67af0e9d5364f7547aaf73935235ac7cafd442710cd3b7e47100cc93a7a7e4fa42e649f2f5ec67cdd97a60c4a56
SSDEEP 96:eK0fRd99dWVM6ZaK9H1p+4yUlo40EYU0iJla4bF2CTpbmpk:HmRd99UMM9Hmqo40f2v2CTopk
TLSH
T165817B5384097FF1273039E9C0DE36A8D52468638A586EE04471FBE282387EC60483BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 b1bd02a27b14028e6a5b2ab81c2caa098a64a7eb230274a871413e45fe9d542f
MD5 6c4baa938907afbf6cea07140c974449
SHA1 8578d3bc501cfdf1aaf26535a3688ba4d09f9de8
SHA512 a898312f4b014ee1353ad59e5f48ba9000cb99447625aeb2408a57b3503c00f63746ef70204d1f63cfd15d60d9855f84dec6a8e38e3fdee445053add1972bbef
SSDEEP 96:eK0fRd99dWVM6ZaK9H1p+4yUlo40EYU0iJla4bF2CTpbmpN:HmRd99UMM9Hmqo40f2v2CTopN
TLSH
T1D2817B5788087FF1273139E9C0EE6698D52568638A586EE04071FBE2813C3ECB0883BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/4872-14-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-15-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-13-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-16-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-12-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-17-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-11-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-19-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-10-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-20-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-9-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-7-0x00000161FBA20000-0x00000161FBA42000-memory.dmp

Download

memory/4872-8-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-4-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4872-3-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp

Download

memory/5720-28-0x000001A36A660000-0x000001A36A67E000-memory.dmp

Download

memory/5720-29-0x000001A36A7F0000-0x000001A36A8A2000-memory.dmp

Download

memory/5720-30-0x000001A36A610000-0x000001A36A61A000-memory.dmp

Download